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prepared the following complete text of the Fair Credit Reporting Act 
(FCRA), 15 U.S.C. § 1681 et seq. Although staff generally followed 
the format of the U.S. Code as published by the Government Printing Office, 
the format of this text does differ in minor ways from the Code (and from 
West’s U.S. Code Annotated). For example, this version uses FCRA section 
numbers (§§ 601-629) in the headings. (The relevant U.S. Code citation 
is included with each section heading and each reference to the FCRA in 
the text.) Although the staff has made every effort to transcribe the statutory 
material accurately, this compendium is intended only as a convenience for 
the public and not a substitute for the text in the U.S. Code. 


This version of the FCRA includes the amendments to the FCRA set forth in 
the Consumer Credit Reporting Reform Act of 1996 (Public Law 104-208, the 
Omnibus Consolidated Appropriations Act for Fiscal Year 1997, Title I, 
Subtitle D, Chapter 1), Section 311 of the Intelligence Authorization for Fiscal 
Year 1998 (Public Law 105-107), the Consumer Reporting Employment 
Clarification Act of 1998 (Public Law 105-347), Section 506 of the Gramm- 
Leach-Bliley Act (Public Law 106-102), Sections 358(g) and 505(c) of the 
Uniting and Strengthening America by Providing Appropriate Tools Required 
to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act) (Public 
Law 107-56), the Fair and Accurate Credit Transactions Act of 2003 (FACT 
Act) (Public Law 108-159), Section 719 of the Financial Services Regulatory 
Relief Act of 2006 (Public Law 109-351), Section 743 (Div. D, Title VID) of 
the Consolidated Appropriations Act of 2008 (Public Law 110-161), the Credit 
and Debit Card Receipt Clarification Act of 2007 (Public Law 110-241), and 
Sections 205 and 302 of the Credit Card Accountability Responsibility and 
Disclosure (CARD) Act of 2009 (Public Law 111-24), the Consumer Financial 
Protection Act of 2010 (CFPA) (Title X of the Dodd-Frank Wall Street Reform 
and Consumer Protection Act, Public Law 111-203), and the Red Flag Program 
Clarification Act of 2010 (Public Law 111-203), and Sections 301, 302, and 
602 of the Economic Growth, Regulatory Relief, and Consumer Protection Act 
(Public Law 115-174), and the National Defense Authorization Act for Fiscal 
Year 2022 (Public Law 117-81). The Commission website posted this document 
on September 1, 2011. 


The provisions added to the FCRA by the FACT Act became effective at 
different times. In some cases, the provision includes its own effective date. In 
other cases, the FACT Act provides that the effective dates be prescribed by the 
FTC and Federal Reserve Board. See 16 CFR Part 602 (69 Fed. Reg. 6526; 
February 11, 2004) (69 Fed. Reg. 29061; May 20, 2004). 


The provisions added to the FCRA by the CFPA became effective on July 21, 2011, 
the “designated transfer date” on which the Bureau of Consumer Financial 
Protection assumed certain duties specified by the CFPA. See 75 Fed. Reg. 57252 
(Sept. 20, 2010). 


A s a public service, the staff of the Federal Trade Commission (FTC) has 
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§ 601. Short title 
This title may be cited as the “Fair Credit Reporting Act.” 


§ 602. Congressional findings and statement of purpose 
[15 U.S.C. § 1681] 


(a) Accuracy and fairness of credit reporting. The Congress makes the 
following findings: 


(1) The banking system is dependent upon fair and accurate credit 
reporting. Inaccurate credit reports directly impair the efficiency of 
the banking system, and unfair credit reporting methods undermine 
the public confidence which is essential to the continued functioning 
of the banking system. 


(2) An elaborate mechanism has been developed for investigating and 
evaluating the credit worthiness, credit standing, credit capacity, 
character, and general reputation of consumers. 


(3) Consumer reporting agencies have assumed a vital role in assembling 
and evaluating consumer credit and other information on consumers. 


(4) There is a need to insure that consumer reporting agencies exercise 
their grave responsibilities with fairness, impartiality, and a respect 
for the consumer’s right to privacy. 


(b) Reasonable procedures. It is the purpose of this title to require that 
consumer reporting agencies adopt reasonable procedures for meeting the 
needs of commerce for consumer credit, personnel, insurance, and other 
information in a manner which is fair and equitable to the consumer, with 
regard to the confidentiality, accuracy, relevancy, and proper utilization of 
such information in accordance with the requirements of this title. 


§ 603. Definitions; rules of construction [15 U.S.C. § 1681a] 


(a) Definitions and rules of construction set forth in this section are applicable 
for the purposes of this title. 


(b) The term “person” means any individual, partnership, corporation, trust, 
estate, cooperative, association, government or governmental subdivision 
or agency, or other entity. 


(c) The term “consumer” means an individual. 
(d) Consumer Report 


(1) In general. The term “consumer report” means any written, oral, 
or other communication of any information by a consumer reporting 
agency bearing on a consumer’s credit worthiness, credit standing, 

1 


§ 603 - 15 U.S.C. § 1681a 


credit capacity, character, general reputation, personal characteristics, 
or mode of living which is used or expected to be used or collected in 
whole or in part for the purpose of serving as a factor in establishing 

the consumer’s eligibility for 


(A) credit or insurance to be used primarily for personal, family, or 
household purposes; 


(B) employment purposes; or 
(C) any other purpose authorized under section 604 [§ 1681b]. 


(2) Exclusions. Except as provided in paragraph (3), the term “consumer 
report” does not include 


(A) _ subject to section 624, any 


(i) report containing information solely as to transactions or 
experiences between the consumer and the person making 
the report; 


(ii) communication of that information among persons related 
by common ownership or affiliated by corporate control; or 


(iii) Communication of other information among persons 
related by common ownership or affiliated by corporate 
control, if it is clearly and conspicuously disclosed to 
the consumer that the information may be communicated 
among such persons and the consumer is given the 
opportunity, before the time that the information is initially 
communicated, to direct that such information not be 
communicated among such persons; 


(B) any authorization or approval of a specific extension of credit 
directly or indirectly by the issuer of a credit card or similar device; 


(C) any report in which a person who has been requested by a third 
party to make a specific extension of credit directly or indirectly 
to a consumer conveys his or her decision with respect to such 
request, if the third party advises the consumer of the name and 
address of the person to whom the request was made, and such 
person makes the disclosures to the consumer required under 
section 615 [§ 1681m]; or 


(D) acommunication described in subsection (0) or (x).! 


(3) Restriction on sharing of medical information. Except for information 
or any communication of information disclosed as provided in section 


1 Should be read as “(o) or (y)” because section 603(x) was re-designated as 603(y) in 2010 by the CFPA. 
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(f) 


(g) 


(h) 


(i) 
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604(g)(3), the exclusions in paragraph (2) shall not apply with respect 
to information disclosed to any person related by common ownership 
or affiliated by corporate control, if the information is - 


(A) medical information; 


(B) an individualized list or description based on the payment 
transactions of the consumer for medical products or services; or 


(C) an aggregate list of identified consumers based on payment 
transactions for medical products or services. 


The term “investigative consumer report” means a consumer report or 
portion thereof in which information on a consumer’s character, general 
reputation, personal characteristics, or mode of living is obtained through 
personal interviews with neighbors, friends, or associates of the consumer 
reported on or with others with whom he is acquainted or who may have 
knowledge concerning any such items of information. However, such 
information shall not include specific factual information on a consumer’s 
credit record obtained directly from a creditor of the consumer or from a 
consumer reporting agency when such information was obtained directly 
from a creditor of the consumer or from the consumer. 


The term “consumer reporting agency” means any person which, for 
monetary fees, dues, or on a cooperative nonprofit basis, regularly engages 
in whole or in part in the practice of assembling or evaluating consumer 
credit information or other information on consumers for the purpose of 
furnishing consumer reports to third parties, and which uses any means or 
facility of interstate commerce for the purpose of preparing or furnishing 
consumer reports. 


The term “file,” when used in connection with information on any 
consumer, means all of the information on that consumer recorded and 
retained by a consumer reporting agency regardless of how the information 
is stored. 


The term “employment purposes” when used in connection with a 
consumer report means a report used for the purpose of evaluating a 
consumer for employment, promotion, reassignment or retention as 
an employee. 


The term “medical information” — 


(1) means information or data, whether oral or recorded, in any form 
or medium, created by or derived from a health care provider or the 
consumer, that relates to - 


(A) _ the past, present, or future physical, mental, or behavioral 
health or condition of an individual; 
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(2) 


(B) _ the provision of health care to an individual; or 

(C) the payment for the provision of health care to an individual. 
does not include the age or gender of a consumer, demographic 
information about the consumer, including a consumer’s residence 
address or e-mail address, or any other information about a consumer 
that does not relate to the physical, mental, or behavioral health or 
condition of a consumer, including the existence or value of any 
insurance policy. 


(j) Definitions Relating to Child Support Obligations 


(1) 
(2) 


The “overdue support” has the meaning given to such term in section 
666(e) of title 42 [Social Security Act, 42 U.S.C. § 666(e)]. 

The term “State or local child support enforcement agency” means a 
State or local agency which administers a State or local program for 
establishing and enforcing child support obligations. 


(k) Adverse Action 
(1) Actions included. The term “adverse action” - 


(A) has the same meaning as in section 701(d)(6) of the Equal 

Credit Opportunity Act; and 

(B) means 

(i) adenial or cancellation of, an increase in any charge for, 
or a reduction or other adverse or unfavorable change in 
the terms of coverage or amount of, any insurance, 
existing or applied for, in connection with the underwriting 
of insurance; 

(ii) a denial of employment or any other decision for 
employment purposes that adversely affects any current or 
prospective employee; 

(iii) a denial or cancellation of, an increase in any charge for, 
or any other adverse or unfavorable change in the terms 
of, any license or benefit described in section 604(a)(3)(D) 
[§ 1681b]; and 

(iv) an action taken or determination that is 
(1) made in connection with an application that was made 

by, or a transaction that was initiated by, any 

consumer, or in connection with a review of an 

account under section 604(a)(3)(F)(ii)[§ 1681b]; and 
(II) adverse to the interests of the consumer. 


(2) Applicable findings, decisions, commentary, and orders. For purposes 


of any determination of whether an action is an adverse action under 
paragraph (1)(A), all appropriate final findings, decisions, commentary, 
and orders issued under section 701(d)(6) of the Equal Credit 
Opportunity Act by the Bureau or any court shall apply. 


(2) The term “firm offer of credit or insurance” means any offer of credit or 
insurance to a consumer that will be honored if the consumer is 
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determined, based on information in a consumer report on the consumer, to 
meet the specific criteria used to select the consumer for the offer, except 
that the offer may be further conditioned on one or more of the following: 


(1) The consumer being determined, based on information in the 
consumer’s application for the credit or insurance, to meet specific 
criteria bearing on credit worthiness or insurability, as applicable, 
that are established 
(A) _ before selection of the consumer for the offer; and 
(B) for the purpose of determining whether to extend credit or 

insurance pursuant to the offer. 

(2) Verification 
(A) _ that the consumer continues to meet the specific criteria used 

to select the consumer for the offer, by using information in a 
consumer report on the consumer, information in the consumer’s 
application for the credit or insurance, or other information 
bearing on the credit worthiness or insurability of the 
consumer; or 


(B) of the information in the consumer’s application for the credit 
or insurance, to determine that the consumer meets the specific 
criteria bearing on credit worthiness or insurability. 


(3) The consumer furnishing any collateral that is a requirement for the 
extension of the credit or insurance that was 


(A) established before selection of the consumer for the offer of 
credit or insurance; and 


(B) disclosed to the consumer in the offer of credit or insurance. 


The term “credit or insurance transaction that is not initiated by the con- 
sumer” does not include the use of a consumer report by a person with 
which the consumer has an account or insurance policy, for purposes of 


(1) reviewing the account or insurance policy; or 
(2) collecting the account. 


The term “State” means any State, the Commonwealth of Puerto Rico, the 
District of Columbia, and any territory or possession of the United States. 


Excluded communications. A communication is described in this 
subsection if it is a communication 


(1) that, but for subsection (d)(2)(D), would be an investigative 
consumer report; 


(2) that is made to a prospective employer for the purpose of 
(A) procuring an employee for the employer; or 
(B) procuring an opportunity for a natural person to work for the 
employer; 
(3) that is made by a person who regularly performs such procurement; 
(4) that is not used by any person for any purpose other than a purpose 
described in subparagraph (A) or (B) of paragraph (2); and 
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(5) with respect to which 
(A) the consumer who is the subject of the communication 


(i) consents orally or in writing to the nature and scope of the 
communication, before the collection of any information 
for the purpose of making the communication; 


(ii) consents orally or in writing to the making of the 
communication to a prospective employer, before the 
making of the communication; and 


(iii) in the case of consent under clause (i) or (ii) given orally, 
is provided written confirmation of that consent by the 
person making the communication, not later than 3 business 
days after the receipt of the consent by that person; 


(B) the person who makes the communication does not, for the 
purpose of making the communication, make any inquiry that 
if made by a prospective employer of the consumer who is the 
subject of the communication would violate any applicable 
Federal or State equal employment opportunity law or 
regulation; and 


(C) the person who makes the communication 


(i) discloses in writing to the consumer who is the subject of 
the communication, not later than 5 business days after 
receiving any request from the consumer for such 
disclosure, the nature and substance of all information in 
the consumer’s file at the time of the request, except that 
the sources of any information that is acquired solely for 
use in making the communication and is actually used for 
no other purpose, need not be disclosed other than under 
appropriate discovery procedures in any court of competent 
jurisdiction in which an action is brought; and 


(ii) notifies the consumer who is the subject of the 
communication, in writing, of the consumer’s right to 
request the information described in clause (i). 


(p) The term “consumer reporting agency that compiles and maintains 
files on consumers on a nationwide basis” means a consumer reporting 
agency that regularly engages in the practice of assembling or 
evaluating, and maintaining, for the purpose of furnishing consumer 
reports to third parties bearing on a consumer’s credit worthiness, credit 
standing, or credit capacity, each of the following regarding consumers 
residing nationwide: 


(q) 
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(1) Public record information. 


(2) Credit account information from persons who furnish that 
information regularly and in the ordinary course of business. 


Definitions relating to fraud alerts. 


(1) The term “active duty military consumer” means a consumer in 
military service who - 


(A) is on active duty (as defined in section 101(d)(1) of title 10, 
United States Code) or is a reservist performing duty under a 
call or order to active duty under a provision of law referred 
to in section 101(a)(13) of title 10, United States Code; and 


(B) is assigned to service away from the usual duty station of the 
consumer. 


(2) The terms “fraud alert” and “active duty alert” mean a statement in 
the file of a consumer that - 


(A) notifies all prospective users of a consumer report relating to 
the consumer that the consumer may be a victim of fraud, 
including identity theft, or is an active duty military consum- 
er, as applicable; and 


(B) is presented in a manner that facilitates a clear and conspicu- 
ous view of the statement described in subparagraph (A) by 
any person requesting such consumer report. 


(3) The term “identity theft” means a fraud committed using the 
identifying information of another person, subject to such further 
definition as the Bureau may prescribe, by regulation. 


See also 12 CFR Part 1022.3(h) 


(4) The term “identity theft report” has the meaning given that term by 
rule of the Bureau, and means, at a minimum, a report - 


See also 12 CFR Part 1022.3(i) 


(A) | that alleges an identity theft; 


(B) that is a copy of an official, valid report filed by a consumer 
with an appropriate Federal, State, or local law enforcement 
agency, including the United States Postal Inspection Service, 
or such other government agency deemed appropriate by the 
Bureau; and 


(C) _ the filing of which subjects the person filing the report to 
criminal penalties relating to the filing of false information if, 
in fact, the information in the report is false. 
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(s) 
(t) 


(u) 


(v) 
(w) 
(x) 


(5) The term “new credit plan” means a new account under an open end 
credit plan (as defined in section 103(i) of the Truth in Lending Act) 
or a new credit transaction not under an open end credit plan. 


Credit and Debit Related Terms 

(1) The term “card issuer” means — 
(A) acredit card issuer, in the case of a credit card; and 
(B) a debit card issuer, in the case of a debit card. 


(2) The term “credit card” has the same meaning as in section 103 of the 
Truth in Lending Act. 


(3) The term “debit card” means any card issued by a financial institution 
to a consumer for use in initiating an electronic fund transfer from 
the account of the consumer at such financial institution, for the 
purpose of transferring money between accounts or obtaining money, 
property, labor, or services. 


(4) The terms “account” and “electronic fund transfer” have the same 
meanings as in section 903 of the Electronic Fund Transfer Act. 

(5) The terms “credit” and “creditor” have the same meanings as in 
section 702 of the Equal Credit Opportunity Act. 

The term “Federal banking agency” has the same meaning as in section 3 

of the Federal Deposit Insurance Act. 


The term “financial institution” means a State or National bank, a State 

or Federal savings and loan association, a mutual savings bank, a State or 

Federal credit union, or any other person that, directly or indirectly, holds 

a transaction account (as defined in section 19(b) of the Federal Reserve 

Act) belonging to a consumer. 

The term “reseller” means a consumer reporting agency that - 

(1) assembles and merges information contained in the database of 
another consumer reporting agency or multiple consumer reporting 
agencies concerning any consumer for purposes of furnishing such 
information to any third party, to the extent of such activities; and 


(2) does not maintain a database of the assembled or merged information 
from which new consumer reports are produced. 


The term “Commission” means the Federal Trade Commission. 
The term “Bureau” means the Bureau of Consumer Financial Protection. 


The term “nationwide specialty consumer reporting agency” means a 
consumer reporting agency that compiles and maintains files on consumers 
on a nationwide basis relating to - 


(1) medical records or payments; 
(2) residential or tenant history; 
(3) check writing history; 
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(4) employment history; or 
(5) insurance claims. 

(y) Exclusion of Certain Communications for Employee Investigations 
(1) A communication is described in this subsection if - 


(A) _ but for subsection (d)(2)(D), the communication would be a 
consumer report; 


(B) the communication is made to an employer in connection with 
an investigation of - 


(i) suspected misconduct relating to employment; or 


(ii) compliance with Federal, State, or local laws and 
regulations, the rules of a self-regulatory organization, 
or any preexisting written policies of the employer; 


(C) the communication is not made for the purpose of investigating 
a consumer’s credit worthiness, credit standing, or credit 
capacity; and 


(D) the communication is not provided to any person except - 
(i) to the employer or an agent of the employer; 


(ii) to any Federal or State officer, agency, or department, 
or any officer, agency, or department of a unit of general 
local government; 


(iii) to any self-regulatory organization with regulatory 
authority over the activities of the employer or employee; 


(iv) as otherwise required by law; or 
(v) pursuant to section 608. 


(2) Subsequent disclosure. After taking any adverse action based in 
whole or in part on a communication described in paragraph (1), the 
employer shall disclose to the consumer a summary containing the 
nature and substance of the communication upon which the adverse 
action is based, except that the sources of information acquired solely 
for use in preparing what would be but for subsection (d)(2)(D) an 
investigative consumer report need not be disclosed. 


(3) For purposes of this subsection, the term “self-regulatory organization” 
includes any self-regulatory organization (as defined in section 3(a) 
(26) of the Securities Exchange Act of 1934), any entity established 
under title I of the Sarbanes-Oxley Act of 2002, any board of trade 
designated by the Commodity Futures Trading Commission, and any 
futures association registered with such Commission. 


(z) Veteran. The term ‘veteran’ has the meaning given the term in section 101 
of title 38, United States Code. 
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(aa) Veteran’s medical debt. The term ‘veteran’s medical debt’ 


(1) means a medical collection debt of a veteran owed to a non-Department 
of Veterans Affairs health care provider that was submitted to the 
Department for payment for health care authorized by the 
Department of Veterans Affairs; and 


(2) includes medical collection debt that the Department of Veterans 
Affairs has wrongfully charged a veteran. 


§ 604. Permissible purposes of consumer reports 
[15 U.S.C. § 1681b] 


(a) In general. Subject to subsection (c), any consumer reporting agency may 
furnish a consumer report under the following circumstances and no other: 


(1) In response to the order of a court having jurisdiction to issue such an 
order, or a subpoena issued in connection with proceedings before a 
Federal grand jury. 


(2) In accordance with the written instructions of the consumer to whom 
it relates. 


(3) Toa person which it has reason to believe 


(A) 


(B) 
(C) 


(D) 


(E) 


(F) 


intends to use the information in connection with a credit 
transaction involving the consumer on whom the information 
is to be furnished and involving the extension of credit to, or 
review or collection of an account of, the consumer; or 


intends to use the information for employment purposes; or 


intends to use the information in connection with the 
underwriting of insurance involving the consumer; or 


intends to use the information in connection with a determination 
of the consumer’s eligibility for a license or other benefit 
granted by a governmental instrumentality required by law to 
consider an applicant’s financial responsibility or status; or 


intends to use the information, as a potential investor or 
servicer, or current insurer, in connection with a valuation of, 
or an assessment of the credit or prepayment risks associated 
with, an existing credit obligation; or 


otherwise has a legitimate business need for the information 


(i) in connection with a business transaction that is initiated 
by the consumer; or 


(b) 


(4) 


(5) 


(6) 
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(ii) to review an account to determine whether the consumer 
continues to meet the terms of the account. 


(G) executive departments and agencies in connection with the 
issuance of government-sponsored individually-billed travel 
charge cards.” 


In response to a request by the head of a State or local child support 
enforcement agency (or a State or local government official 
authorized by the head of such an agency), if the person making the 
request certifies to the consumer reporting agency that - 


(A) the consumer report is needed for the purpose of establishing an 
individual’s capacity to make child support payments, determining 
the appropriate level of such payments, or enforcing a child 
support order, award, agreement, or judgment; 


(B) the parentage of the consumer for the child to which the 
obligation relates has been established or acknowledged by the 
consumer in accordance with State laws under which the 
obligation arises (if required by those laws); and 


(C) the consumer report will be kept confidential, will be used 
solely for a purpose described in subparagraph (A), and will 
not be used in connection with any other civil, administrative, 
or criminal proceeding, or for any other purpose. 


To an agency administering a State plan under section 654 of title 42 
for use to set an initial or modified child support award. 


To the Federal Deposit Insurance Corporation or the National Credit 
Union Administration as part of its preparation for its appointment or 
as part of its exercise of powers, as conservator, receiver, or 
liquidating agent for an insured depository institution or insured 
credit union under the Federal Deposit Insurance Act or the Federal 
Credit Union Act, or other applicable Federal or State law, or in 
connection with the resolution or liquidation of a failed or failing 
insured depository institution or insured credit union, as applicable. 


Conditions for furnishing and using consumer reports for 
employment purposes. 


(Cl) 


Certification from user. A consumer reporting agency may furnish a 
consumer report for employment purposes only if 


2 As written in the 2007 amendment that added section 604(a)(3)(G). Subsection F(ii) should end with 
“; or” instead of a period, and the text of subsection (g) should conform to the style of the rest of section 


605(a)(3). 
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(A) the person who obtains such report from the agency certifies to 


(B) 


the agency that 


(i) _ the person has complied with paragraph (2) with respect 
to the consumer report, and the person will comply with 
paragraph (3) with respect to the consumer report if 
paragraph (3) becomes applicable; and 


(ii) information from the consumer report will not be used 
in violation of any applicable Federal or State equal 
employment opportunity law or regulation; and 


the consumer reporting agency provides with the report, or 
has previously provided, a summary of the consumer’s rights 
under this title, as prescribed by the Bureau under section 
609(c)(3) [§ 1681 g]. 


(2) Disclosure to Consumer. 


(A) Jn general. Except as provided in subparagraph (B), a person 


(B) 


may not procure a consumer report, or cause a consumer report 
to be procured, for employment purposes with respect to any 
consumer, unless — 


(i) aclear and conspicuous disclosure has been made in 
writing to the consumer at any time before the report is 
procured or caused to be procured, in a document that 
consists solely of the disclosure, that a consumer report 
may be obtained for employment purposes; and 


(ii) the consumer has authorized in writing (which authorization 
may be made on the document referred to in clause (i)) the 
procurement of the report by that person. 


Application by mail, telephone, computer, or other similar 
means. If a consumer described in subparagraph (C) applies 
for employment by mail, telephone, computer, or other similar 
means, at any time before a consumer report is procured or 
caused to be procured in connection with that application - 


(i) _ the person who procures the consumer report on the 
consumer for employment purposes shall provide to the 
consumer, by oral, written, or electronic means, notice 
that a consumer report may be obtained for employment 
purposes, and a summary of the consumer’s rights under 
section 615(a)(3); and 
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(ii) the consumer shall have consented, orally, in writing, or 
electronically to the procurement of the report by that person. 


(C) Scope. Subparagraph (B) shall apply to a person procuring a 
consumer report on a consumer in connection with the 
consumer’s application for employment only if - 


(i) the consumer is applying for a position over which the 
Secretary of Transportation has the power to establish 
qualifications and maximum hours of service pursuant to 
the provisions of section 31502 of title 49, or a 
position subject to safety regulation by a State 
transportation agency; and 


(ii) as of the time at which the person procures the report 
or causes the report to be procured the only interaction 
between the consumer and the person in connection with 
that employment application has been by mail, telephone, 
computer, or other similar means. 


(3) Conditions on use for adverse actions. 


(A) Jn general. Except as provided in subparagraph (B), in using 
a consumer report for employment purposes, before taking 
any adverse action based in whole or in part on the report, the 
person intending to take such adverse action shall provide to the 
consumer to whom the report relates - 


(i) acopy of the report; and 


Gi) a description in writing of the rights of the consumer 
under this title, as prescribed by the Bureau under section 
609(c)(3).? 


(B) Application by mail, telephone, computer, or other similar means. 


(i) Ifa consumer described in subparagraph (C) applies for 
employment by mail, telephone, computer, or other 
similar means, and if a person who has procured a 
consumer report on the consumer for employment purposes 
takes adverse action on the employment application based 
in whole or in part on the report, then the person must 
provide to the consumer to whom the report relates, in 
lieu of the notices required under subparagraph (A) of 
this section and under section 615(a), within 3 business 


3 The references in Sections 604(b)(3)(A) and 604(b)(3)(B) should be to Section 609(c)(1), not (c)(3) that no 
longer exists as the result of Congress’ re-organization of Section 609(c) in 2003 (FACT Act). 
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(C) 


(ii) 


days of taking such action, an oral, written or electronic 
notification — 


(1) that adverse action has been taken based in whole 
or in part on a consumer report received from a 
consumer reporting agency; 


(II) of the name, address and telephone number of 
the consumer reporting agency that furnished the 
consumer report (including a toll-free telephone 
number established by the agency if the agency 
compiles and maintains files on consumers on a 
nationwide basis); 


(III) that the consumer reporting agency did not make the 
decision to take the adverse action and is unable to 
provide to the consumer the specific reasons why the 
adverse action was taken; and 


(IV) that the consumer may, upon providing proper 
identification, request a free copy of a report and may 
dispute with the consumer reporting agency the 
accuracy or completeness of any information in a report. 


If, under clause (B)(i)(IV), the consumer requests a copy 
of a consumer report from the person who procured the 
report, then, within 3 business days of receiving the 
consumer’s request, together with proper identification, 
the person must send or provide to the consumer a copy of 
a report and a copy of the consumer’s rights as prescribed 
by the Bureau under section 609(c)(3).? 


Scope. Subparagraph (B) shall apply to a person procuring a 
consumer report on a consumer in connection with the 
consumer’s application for employment only if - 


(i) 


(ii) 


the consumer is applying for a position over which the 
Secretary of Transportation has the power to establish 
qualifications and maximum hours of service pursuant to 
the provisions of section 31502 of title 49, or a 

position subject to safety regulation by a State 
transportation agency; and 


as of the time at which the person procures the report 
or causes the report to be procured the only interaction 
between the consumer and the person in connection with 
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that employment application has been by mail, telephone, 
computer, or other similar means. 


(4) Exception for national security investigations. 


(A) Jn general. In the case of an agency or department of the 


(B) 


United States Government which seeks to obtain and use a 
consumer report for employment purposes, paragraph (3) shall 
not apply to any adverse action by such agency or department 
which is based in part on such consumer report, if the head of 
such agency or department makes a written finding that - 


(i) the consumer report is relevant to a national security 
investigation of such agency or department; 


(ii) the investigation is within the jurisdiction of such agency 
or department; 


(iii) there is reason to believe that compliance with paragraph 
(3) will - 


(1) endanger the life or physical safety of any person; 
(I) result in flight from prosecution; 


(IT) result in the destruction of, or tampering with, 
evidence relevant to the investigation; 


(IV) result in the intimidation of a potential witness 
relevant to the investigation; 


(V) result in the compromise of classified information; or 


(VI) otherwise seriously jeopardize or unduly delay the 
investigation or another official proceeding. 


Notification of consumer upon conclusion of investigation. 
Upon the conclusion of a national security investigation 
described in subparagraph (A), or upon the determination that 
the exception under subparagraph (A) is no longer required for 
the reasons set forth in such subparagraph, the official exercising 
the authority in such subparagraph shall provide to the consumer 
who is the subject of the consumer report with regard to which 
such finding was made - 


(i) acopy of such consumer report with any classified 
information redacted as necessary; 


(ii) notice of any adverse action which is based, in part, on 
the consumer report; and 
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(iii) the identification with reasonable specificity of the nature 


of the investigation for which the consumer report was 
sought. 


(C) Delegation by head of agency or department. For purposes of 
subparagraphs (A)and (B), the head of any agency or department 
of the United States Government may delegate his or her 
authorities under this paragraph to an official of such agency or 
department who has personnel security responsibilities and is a 
member of the Senior Executive Service or equivalent civilian 
or military rank. 


(D) 


Definitions. For purposes of this paragraph, the following 
definitions shall apply: 


(i) 


(ii) 


Classified information. The term “classified information” 
means information that is protected from unauthorized 
disclosure under Executive Order No. 12958 or successor 
orders. 


National security investigation. The term “national security 
investigation” means any official inquiry by an agency or 
department of the United States Government to determine 
the eligibility of a consumer to receive access or continued 
access to classified information or to determine whether 
classified information has been lost or compromised. 


(c) Furnishing reports in connection with credit or insurance transactions that 
are not initiated by the consumer. 


(1) Jn general. A consumer reporting agency may furnish a consumer 
report relating to any consumer pursuant to subparagraph (A) or (C) 
of subsection (a)(3) in connection with any credit or insurance 
transaction that is not initiated by the consumer only if 


(A) the consumer authorizes the agency to provide such report to 
such person; or 


(B) 


(i) 
(ii) 


(iii) 


the transaction consists of a firm offer of credit or insurance; 


the consumer reporting agency has complied with 
subsection (e); 


there is not in effect an election by the consumer, made 
in accordance with subsection (e), to have the consumer’s 
name and address excluded from lists of names provided 
by the agency pursuant to this paragraph; and 
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(iv) the consumer report does not contain a date of birth that 
shows that the consumer has not attained the age of 21, 
or, if the date of birth on the consumer report shows that 
the consumer has not attained the age of 21, such 
consumer consents to the consumer reporting agency to 
such furnishing. 


(2) Limits on information received under paragraph (1)(B). A person 


may receive pursuant to paragraph (1)(B) only 
(A) the name and address of a consumer; 
(B) an identifier that is not unique to the consumer and that is used 


by the person solely for the purpose of verifying the identity of 
the consumer; and 


(C) other information pertaining to a consumer that does not identify 
the relationship or experience of the consumer with respect to a 
particular creditor or other entity. 


(3) Information regarding inquiries. Except as provided in section 609(a) 


(5) [§ 1681g], a consumer reporting agency shall not furnish to any 
person a record of inquiries in connection with a credit or 
insurance transaction that is not initiated by a consumer. 


(d) Reserved. 


(e) Election of consumer to be excluded from lists. 


(1) Jn general. A consumer may elect to have the consumer’s name and 


(2) 


address excluded from any list provided by a consumer reporting 
agency under subsection (c)(1)(B) in connection with a credit or 
insurance transaction that is not initiated by the consumer, by 
notifying the agency in accordance with paragraph (2) that the 
consumer does not consent to any use of a consumer report relating 
to the consumer in connection with any credit or insurance 
transaction that is not initiated by the consumer. 


Manner of notification. A consumer shall notify a consumer 

reporting agency under paragraph (1) 

(A) through the notification system maintained by the agency under 
paragraph (5); or 


(B) by submitting to the agency a signed notice of election form 
issued by the agency for purposes of this subparagraph. 


(3) Response of agency after notification through system. Upon receipt 


of notification of the election of a consumer under paragraph (1) 
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through the notification system maintained by the agency under 
paragraph (5), a consumer reporting agency shall 


(A) 


(B) 


inform the consumer that the election is effective only for the 
5-year period following the election if the consumer does not 
submit to the agency a signed notice of election form issued by 
the agency for purposes of paragraph (2)(B); and 


provide to the consumer a notice of election form, if requested 
by the consumer, not later than 5 business days after receipt of 
the notification of the election through the system established 
under paragraph (5), in the case of a request made at the time 
the consumer provides notification through the system. 


(4) Effectiveness of election. An election of a consumer under 
paragraph (1) 


(5) 


(A) 


(B) 


(C) 


(D) 


shall be effective with respect to a consumer reporting agency 
beginning 5 business days after the date on which the consumer 
notifies the agency in accordance with paragraph (2); 


shall be effective with respect to a consumer reporting agency 


(i) subject to subparagraph (C), during the 5-year period 
beginning 5 business days after the date on which the 
consumer notifies the agency of the election, in the case of 
an election for which a consumer notifies the agency only 
in accordance with paragraph (2)(A); or 


(ii) until the consumer notifies the agency under subparagraph 
(C), in the case of an election for which a consumer 
notifies the agency in accordance with paragraph (2)(B); 


shall not be effective after the date on which the consumer 
notifies the agency, through the notification system established 
by the agency under paragraph (5), that the election is no 
longer effective; and 


shall be effective with respect to each affiliate of the agency. 


Notification System 


(A) 


In general. Each consumer reporting agency that, under 
subsection (c)(1)(B), furnishes a consumer report in connection 
with a credit or insurance transaction that is not initiated by a 
consumer, shall 


(i) establish and maintain a notification system, including a 
toll-free telephone number, which permits any consumer 
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whose consumer report is maintained by the agency to 
notify the agency, with appropriate identification, of the 
consumer’s election to have the consumer’s name and 
address excluded from any such list of names and addresses 
provided by the agency for such a transaction; and 


Gi) publish by not later than 365 days after the date of enactment 
of the Consumer Credit Reporting Reform Act of 1996, 
and not less than annually thereafter, in a publication of 
general circulation in the area served by the agency 


(1) a notification that information in consumer files 
maintained by the agency may be used in connection 
with such transactions; and 


(II) the address and toll-free telephone number for 
consumers to use to notify the agency of the 
consumer’s election under clause (1). 


(B) Establishment and maintenance as compliance. Establishment 
and maintenance of a notification system (including a toll-free 
telephone number) and publication by a consumer reporting 
agency on the agency’s own behalf and on behalf of any of its 
affiliates in accordance with this paragraph is deemed to be 
compliance with this paragraph by each of those affiliates. 


(6) Notification system by agencies that operate nationwide. Each 
consumer reporting agency that compiles and maintains files on 
consumers on a nationwide basis shall establish and maintain a 
notification system for purposes of paragraph (5) jointly with other 
such consumer reporting agencies. 


(f) Certain use or obtaining of information prohibited. A person shall not use 
or obtain a consumer report for any purpose unless 


(1) the consumer report is obtained for a purpose for which the consumer 
report is authorized to be furnished under this section; and 


(2) the purpose is certified in accordance with section 607 [§ 1681e] 
by a prospective user of the report through a general or specific 
certification. 


(g) Protection of Medical Information 


(1) Limitation on consumer reporting agencies. A consumer reporting 
agency shall not furnish for employment purposes, or in connection 
with a credit or insurance transaction, a consumer report that contains 
medical information (other than medical contact information treated 
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(2) 


(3) 


in the manner required under section 605(a)(6)) about a consumer, 
unless — 


(A) if furnished in connection with an insurance transaction, the 
consumer affirmatively consents to the furnishing of the report; 


(B) if furnished for employment purposes or in connection with a 
credit transaction - 


(i) _ the information to be furnished is relevant to process or 
effect the employment or credit transaction; and 


(ii) the consumer provides specific written consent for the 
furnishing of the report that describes in clear and 
conspicuous language the use for which the information 
will be furnished; or 


(C) the information to be furnished pertains solely to transactions, 
accounts, or balances relating to debts arising from the receipt 
of medical services, products, or devises, where such 
information, other than account status or amounts, is restricted 
or reported using codes that do not identify, or do not provide 
information sufficient to infer, the specific provider or the 
nature of such services, products, or devices, as provided in 
section 605(a)(6). 


Limitation on creditors. Except as permitted pursuant to paragraph 
(3)(C) or regulations prescribed under paragraph (5)(A), a creditor 
shall not obtain or use medical information (other than medical contact 
information treated in the manner required under section 605(a)(6)) 
pertaining to a consumer in connection with any determination of the 
consumer’s eligibility, or continued eligibility, for credit. 


Actions authorized by federal law, insurance activities and regulatory 
determinations. Section 603(d)(3) shall not be construed so as to treat 
information or any communication of information as a consumer 
report if the information or communication is disclosed - 


(A) in connection with the business of insurance or annuities, 
including the activities described in section 18B of the model 
Privacy of Consumer Financial and Health Information 
Regulation issued by the National Association of Insurance 
Commissioners (as in effect on January 1, 2003); 


(B) for any purpose permitted without authorization under the 
Standards for Individually Identifiable Health Information 
promulgated by the Department of Health and Human Services 
pursuant to the Health Insurance Portability and Accountability 
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Act of 1996, or referred to under section 1179 of such Act, or 
described in section 502(e) of Public Law 106-102; or 


(C) as otherwise determined to be necessary and appropriate, by 
regulation or order, by the Bureau or the applicable State 
insurance authority (with respect to any person engaged in 
providing insurance or annuities). 


(4) Limitation on redisclosure of medical information. Any person that 
receives medical information pursuant to paragraph (1) or (3) shall 
not disclose such information to any other person, except as necessary 
to carry out the purpose for which the information was initially 
disclosed, or as otherwise permitted by statute, regulation, or order. 


(5) Regulations and Effective Date for Paragraph (2) 


(A)* Regulations required. The Bureau may, after notice and 
opportunity for comment, prescribe regulations that permit 
transactions under paragraph (2) that are determined to be 
necessary and appropriate to protect legitimate operational, 
transactional, risk, consumer, and other needs (and which shall 
include permitting actions necessary for administrative verifica- 
tion purposes), consistent with the intent of paragraph (2) to 
restrict the use of medical information for inappropriate purposes. 


See also 12 CFR Parts 41/222/232/334/571/717, 70 Fed. Reg. 70664 (11/22/05) 


(6) Coordination with other laws. No provision of this subsection shall 
be construed as altering, affecting, or superseding the applicability of 
any other provision of Federal law relating to medical confidentiality. 


§ 605. Requirements relating to information contained in 
consumer reports [15 U.S.C. § 1681c] 


(a) Information excluded from consumer reports. Except as authorized under 
subsection (b) of this section, no consumer reporting agency may make any 
consumer report containing any of the following items of information: 


(1) Cases under title 11 [United States Code] or under the Bankruptcy 
Act that, from the date of entry of the order for relief or the date 
of adjudication, as the case may be, antedate the report by more 
than 10 years. 


4 As written in section 1088(a)(4)(B) of the CFPA in 2010. The previous version of section 604(b)(5), 
added in 2003 by the FACT Act, contained two subsections (A) and (B). The latter stated that the rules 
required to be prescribed by the Federal financial agencies (not including the Commission) be finalized 
by June 4, 2004. 
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(2) 


(3) 


(4) 


(5) 


(6) 


(7) 


(8) 


Civil suits, civil judgments, and records of arrest that from date of entry, 
antedate the report by more than seven years or until the governing 
statute of limitations has expired, whichever is the longer period. 


Paid tax liens which, from date of payment, antedate the report by more 
than seven years. 


Accounts placed for collection or charged to profit and loss which 
antedate the report by more than seven years.° 


Any other adverse item of information, other than records of convic- 
tions of crimes which antedates the report by more than seven years.° 


The name, address, and telephone number of any medical information 
furnisher that has notified the agency of its status, unless - 


(A) such name, address, and telephone number are restricted or 
reported using codes that do not identify, or provide information 
sufficient to infer, the specific provider or the nature of such 
services, products, or devices to a person other than the 
consumer; or 


(B) the report is being provided to an insurance company for a 
purpose relating to engaging in the business of insurance other 
than property and casualty insurance. 


With respect to a consumer reporting agency described in section 
603(p), any information related to a veteran’s medical debt if the 
date on which the hospital care, medical services, or extended care 
services was rendered relating to the debt antedates the report by less 
than 1 year if the consumer reporting agency has actual knowledge 
that the information is related to a veteran’s medical debt and the 
consumer reporting agency is in compliance with its obligation under 
section 302(c)(5) of the Economic Growth, Regulatory Relief, and 
Consumer Protection Act. 


With respect to a consumer reporting agency described in section 
603(p), any information related to a fully paid or settled veteran’s 
medical debt that had been characterized as delinquent, charged off, 
or in collection if the consumer reporting agency has actual knowledge 
that the information is related to a veteran’s medical debt and the 
consumer reporting agency is in compliance with its obligation under 


5 The reporting periods have been lengthened for certain adverse information pertaining to U.S. Government 
insured or guaranteed student loans, or pertaining to national direct student loans. See sections 430A(f) and 
463(c)(3) of the Higher Education Act of 1965, 20 U.S.C. 1080a(f) and 20 U.S.C. 1087cc(c)(3), respectively. 
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section 302(c)(5) of the Economic Growth, Regulatory Relief, and 
Consumer Protection Act. 


(b) Exempted cases. The provisions of paragraphs (1) through (5) of 
subsection (a) of this section are not applicable in the case of any 
consumer credit report to be used in connection with 


(c) 


(d) 


(1) 


(2) 


(3) 


a credit transaction involving, or which may reasonably be expected 
to involve, a principal amount of $150,000 or more; 


the underwriting of life insurance involving, or which may 
reasonably be expected to involve, a face amount of $150,000 or 
more; or 


the employment of any individual at an annual salary which equals, 
or which may reasonably be expected to equal $75,000, or more. 


Running of Reporting Period 


(1) In general. The 7-year period referred to in paragraphs (4) and (6)° 


(2) 


of subsection (a) shall begin, with respect to any delinquent account 
that is placed for collection (internally or by referral to a third party, 
whichever is earlier), charged to profit and loss, or subjected to any 
similar action, upon the expiration of the 180-day period beginning 
on the date of the commencement of the delinquency which 
immediately preceded the collection activity, charge to profit and 
loss, or similar action. 


Effective date. Paragraph (1) shall apply only to items of information 
added to the file of a consumer on or after the date that is 455 days 
after the date of enactment of the Consumer Credit Reporting Reform 
Act of 1996. 


Information Required to be Disclosed 


(1) Title 11 information. Any consumer reporting agency that furnishes a 


consumer report that contains information regarding any case 
involving the consumer that arises under title 11, United States Code, 
shall include in the report an identification of the chapter of such title 
11 under which such case arises if provided by the source of the 
information. If any case arising or filed under title 11, United States 
Code, is withdrawn by the consumer before a final judgment, the 
consumer reporting agency shall include in the report that such case 


6 This provision, added in September 1996, should read “paragraphs (4) and (5)....” Prior Section 605(a) 
(6) was amended and re-designated as Section 605(a)(5) in November 1998. The current Section 605(a)(6), 
added in December 2003 and now containing no reference to any 7-year period, is obviously inapplicable. 
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(e) 


(f) 


(g) 


or filing was withdrawn upon receipt of documentation certifying 
such withdrawal. 


(2) Key factor in credit score information. Any consumer reporting 
agency that furnishes a consumer report that contains any credit score 
or any other risk score or predictor on any consumer shall include 
in the report a clear and conspicuous statement that a key factor 
(as defined in section 609(f)(2)(B)) that adversely affected such score 
or predictor was the number of enquiries, if such a predictor was in 
fact a key factor that adversely affected such score. This paragraph 
shall not apply to a check services company, acting as such, which 
issues authorizations for the purpose of approving or processing 
negotiable instruments, electronic fund transfers, or similar methods 
of payments, but only to the extent that such company is engaged in 
such activities. 


Indication of closure of account by consumer. If a consumer reporting 
agency is notified pursuant to section 623(a)(4) [§ 1681s-2] that a credit 
account of a consumer was voluntarily closed by the consumer, the agency 
shall indicate that fact in any consumer report that includes information 
related to the account. 


Indication of dispute by consumer. If a consumer reporting agency is 
notified pursuant to section 623(a)(3) [§ 1681s-2] that information 
regarding a consumer who was furnished to the agency is disputed by the 
consumer, the agency shall indicate that fact in each consumer report that 
includes the disputed information. 


Truncation of Credit Card and Debit Card Numbers 


(1) In general. Except as otherwise provided in this subsection, no 
person that accepts credit cards or debit cards for the transaction of 
business shall print more than the last 5 digits of the card number or 
the expiration date upon any receipt provided to the cardholder at the 
point of the sale or transaction. 


(2) Limitation. This subsection shall apply only to receipts that are 
electronically printed, and shall not apply to transactions in which the 
sole means of recording a credit card or debit card account number is 
by handwriting or by an imprint or copy of the card. 


(3) Effective date. This subsection shall become effective - 
(A) 3 years after the date of enactment of this subsection, with 
respect to any cash register or other machine or device that 
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electronically prints receipts for credit card or debit card 
transactions that is in use before January 1, 2005; and 


(B) 1 year after the date of enactment of this subsection, with respect 
to any cash register or other machine or device that electronically 
prints receipts for credit card or debit card transactions that is 
first put into use on or after January 1, 2005. 


(h) Notice of Discrepancy in Address 


(1) 


(2) 


In general. If a person has requested a consumer report relating to 
a consumer from a consumer reporting agency described in section 
603(p), the request includes an address for the consumer that 
substantially differs from the addresses in the file of the consumer, 
and the agency provides a consumer report in response to the request, 
the consumer reporting agency shall notify the requester of the 
existence of the discrepancy. 

See also 12 CFR Part 1022.82, 16 CFR Part 641, 

72 Fed. Reg. 63771-72 (11/09/07), 


74 Fed. Reg. 22640-41 (05/14/09), 
86 Fed. Reg. 51817-19 (09/17/21) 


Regulations 


(A) Regulations required. The Bureau shall, in consultation with the 
Federal banking agencies, the National Credit Union Adminis- 
tration, and the Federal Trade Commission, prescribe regula- 
tions providing guidance regarding reasonable policies and pro- 
cedures that a user of a consumer report should employ when 
such user has received a notice of discrepancy under paragraph 
(1). 

(B) Policies and procedures to be included. The regulations pre- 
scribed under subparagraph (A) shall describe reasonable poli- 
cies and procedures for use by a user of a consumer report - 


(i) to form a reasonable belief that the user knows the identity 
of the person to whom the consumer report pertains; and 


(ii) if the user establishes a continuing relationship with the 
consumer, and the user regularly and in the ordinary course 
of business furnishes information to the consumer reporting 
agency from which the notice of discrepancy pertaining to 
the consumer was obtained, to reconcile the address of the 
consumer with the consumer reporting agency by furnishing 
such address to such consumer reporting agency as part of 
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information regularly furnished by the user for the period in 
which the relationship is established. 


§ 605A. Identity theft prevention; fraud alerts and active duty 
alerts [15 U.S.C. § 1681c-1] 


(a) One-call Fraud Alerts 


(1) Initial alerts. Upon the direct request of a consumer, or an individual 
acting on behalf of or as a personal representative of a consumer, 
who asserts in good faith a suspicion that the consumer has been or is 
about to become a victim of fraud or related crime, including identity 
theft, a consumer reporting agency described in section 603(p) that 
maintains a file on the consumer and has received appropriate proof 
of the identity of the requester shall - 


(A) include a fraud alert in the file of that consumer, and also 
provide that alert along with any credit score generated in using 
that file, for a period of not less than 1 year, beginning on the 
date of such request, unless the consumer or such representative 
requests that such fraud alert be removed before the end of such 
period, and the agency has received appropriate proof of the 
identity of the requester for such purpose; and 


(B) refer the information regarding the fraud alert under this 
paragraph to each of the other consumer reporting agencies 
described in section 603(p), in accordance with procedures 
developed under section 621(f). 


(2) Access to free reports. In any case in which a consumer reporting 
agency includes a fraud alert in the file of a consumer pursuant to this 
subsection, the consumer reporting agency shall - 


(A) disclose to the consumer that the consumer may request a free 
copy of the file of the consumer pursuant to section 612(d); and 


(B) provide to the consumer all disclosures required to be made 
under section 609, without charge to the consumer, not later 
than 3 business days after any request described in 
subparagraph (A). 

(b) Extended Alerts 
(1) In general. Upon the direct request of a consumer, or an individual 
acting on behalf of or as a personal representative of a consumer, 


who submits an identity theft report to a consumer reporting agency 
described in section 603(p) that maintains a file on the consumer, 
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if the agency has received appropriate proof of the identity of the 
requester, the agency shall - 


(A) include a fraud alert in the file of that consumer, and also 
provide that alert along with any credit score generated in using 
that file, during the 7-year period beginning on the date of such 
request, unless the consumer or such representative requests 
that such fraud alert be removed before the end of such period 
and the agency has received appropriate proof of the identity of 
the requester for such purpose; 


(B) during the 5-year period beginning on the date of such request, 
exclude the consumer from any list of consumers prepared by 
the consumer reporting agency and provided to any third party 
to offer credit or insurance to the consumer as part of a 
transaction that was not initiated by the consumer, unless the 
consumer or such representative requests that such exclusion be 
rescinded before the end of such period; and 


(C) refer the information regarding the extended fraud alert under 
this paragraph to each of the other consumer reporting agen- 
cies described in section 603(p), in accordance with procedures 
developed under section 621(f). 


(2) Access to free reports. In any case in which a consumer reporting 
agency includes a fraud alert in the file of a consumer pursuant to this 
subsection, the consumer reporting agency shall - 


(A) disclose to the consumer that the consumer may request 2 free 
copies of the file of the consumer pursuant to section 612(d) 
during the 12-month period beginning on the date on which the 
fraud alert was included in the file; and 


(B) provide to the consumer all disclosures required to be made 
under section 609, without charge to the consumer, not later 
than 3 business days after any request described in 
subparagraph (A). 

(c) Active duty alerts. Upon the direct request of an active duty military 
consumer, or an individual acting on behalf of or as a personal 
representative of an active duty military consumer, a consumer reporting 
agency described in section 603(p) that maintains a file on the active duty 
military consumer and has received appropriate proof of the identity of the 
requester shall - 


(1) include an active duty alert in the file of that active duty military 
consumer, and also provide that alert along with any credit score 
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(d) 


(e) 


(f) 


generated in using that file, during a period of not less than 12 
months, or such longer period as the Bureau shall determine, by 
regulation, beginning on the date of the request, unless the active 
duty military consumer or such representative requests that such 
fraud alert be removed before the end of such period, and the agency 
has received appropriate proof of the identity of the requester for 
such purpose; 


(2) during the 2-year period beginning on the date of such request, 
exclude the active duty military consumer from any list of consumers 
prepared by the consumer reporting agency and provided to any third 
party to offer credit or insurance to the consumer as part of a 
transaction that was not initiated by the consumer, unless the 
consumer requests that such exclusion be rescinded before the end of 
such period; and 


(3) refer the information regarding the active duty alert to each of the 
other consumer reporting agencies described in section 603(p), in 
accordance with procedures developed under section 621(f). 


See also 12 CFR Part 1022.121 


Procedures. Each consumer reporting agency described in section 603(p) 
shall establish policies and procedures to comply with this section, including 
procedures that inform consumers of the availability of initial, extended, 
and active duty alerts and procedures that allow consumers and active duty 
military consumers to request initial, extended, or active duty alerts (as 
applicable) in a simple and easy manner, including by telephone. 


Referrals of alerts. Each consumer reporting agency described in section 
603(p) that receives a referral of a fraud alert or active duty alert from 
another consumer reporting agency pursuant to this section shall, as 
though the agency received the request from the consumer directly, follow 
the procedures required under - 


(1) paragraphs (1)(A) and (2) of subsection (a), in the case of a referral 
under subsection (a)(1)(B); 


(2) paragraphs (1)(A), (1)(B), and (2) of subsection (b), in the case of a 
referral under subsection (b)(1)(C); and 

(3) paragraphs (1) and (2) of subsection (c), in the case of a referral 
under subsection (c)(3). 


Duty of reseller to reconvey alert. A reseller shall include in its report any 
fraud alert or active duty alert placed in the file of a consumer 
pursuant to this section by another consumer reporting agency. 
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(g) Duty of other consumer reporting agencies to provide contact information. 
If a consumer contacts any consumer reporting agency that is not 
described in section 603(p) to communicate a suspicion that the consumer 
has been or is about to become a victim of fraud or related crime, 
including identity theft, the agency shall provide information to the 
consumer on how to contact the Bureau and the consumer reporting 
agencies described in section 603(p) to obtain more detailed information 
and request alerts under this section. 


(h) 


Limitations on Use of Information for Credit Extensions 


(1) Requirements for initial and active duty alerts 


(A) Notification. Each initial fraud alert and active duty alert under 
this section shall include information that notifies all prospective 
users of a consumer report on the consumer to which the alert 
relates that the consumer does not authorize the establishment 
of any new credit plan or extension of credit, other than under 
an open-end credit plan (as defined in section 103(i)), in the 
name of the consumer, or issuance of an additional card on an 
existing credit account requested by a consumer, or any 
increase in credit limit on an existing credit account requested 
by a consumer, except in accordance with subparagraph (B). 


(B) 


Limitation on Users 


(i) 


(ii) 


In general. No prospective user of a consumer report that 
includes an initial fraud alert or an active duty alert in 
accordance with this section may establish a new credit 
plan or extension of credit, other than under an open-end 
credit plan (as defined in section 103(i)), in the name of 
the consumer, or issue an additional card on an existing 
credit account requested by a consumer, or grant any 
increase in credit limit on an existing credit account 
requested by a consumer, unless the user utilizes reasonable 
policies and procedures to form a reasonable belief that 
the user knows the identity of the person making the request. 


Verification. If a consumer requesting the alert has 
specified a telephone number to be used for identity 
verification purposes, before authorizing any new credit 
plan or extension described in clause (i) in the name of 
such consumer, a user of such consumer report shall 
contact the consumer using that telephone number or take 
reasonable steps to verify the consumer’s identity and 
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confirm that the application for a new credit plan is not 
the result of identity theft. 


(2) Requirements for Extended Alerts 


(A) 


(B) 


Notification. Each extended alert under this section shall 
include information that provides all prospective users of a 
consumer report relating to a consumer with - 


(i) notification that the consumer does not authorize the 
establishment of any new credit plan or extension of credit 
described in clause (i), other than under an open-end 
credit plan (as defined in section 103(i)), in the name of 
the consumer, or issuance of an additional card on an 
existing credit account requested by a consumer, or any 
increase in credit limit on an existing credit account 
requested by a consumer, except in accordance with 
subparagraph (B); and 


(ii) atelephone number or other reasonable contact method 
designated by the consumer. 


Limitation on users. No prospective user of a consumer report 
or of a credit score generated using the information in the file 
of a consumer that includes an extended fraud alert in 
accordance with this section may establish a new credit plan or 
extension of credit, other than under an open-end credit plan 
(as defined in section 103(i)), in the name of the consumer, or 
issue an additional card on an existing credit account requested 
by a consumer, or any increase in credit limit on an existing 
credit account requested by a consumer, unless the user 
contacts the consumer in person or using the contact method 
described in subparagraph (A)(ii) to confirm that the application 
for a new credit plan or increase in credit limit, or request for 
an additional card is not the result of identity theft. 


(i) National security freeze. 


(1) Definitions. For purposes of this subsection: 


(A) 


(B) 


(C) 


The term ‘consumer reporting agency’ means a consumer 
reporting agency described in section 603(p). 


The term ‘proper identification’ has the meaning of such term 
as used under section 610. 


The term ‘security freeze’ means a restriction that prohibits a 
consumer reporting agency from disclosing the contents of a 
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consumer report that is subject to such security freeze to any 
person requesting the consumer report. 


(2) Placement of security freeze. 


(A) 


(B) 


(C) 


In general. Upon receiving a direct request from a consumer 
that a consumer reporting agency place a security freeze, and 
upon receiving proper identification from the consumer, the 
consumer reporting agency shall, free of charge, place the 
security freeze not later than - 


(i) in the case of a request that is by toll-free telephone or 
secure electronic means, 1 business day after receiving the 
request directly from the consumer; or 


(ii) in the case of a request that is by mail, 3 business days 
after receiving the request directly from the consumer. 


Confirmation and additional information. 


Not later than 5 business days after placing a security freeze 
under subparagraph (A), a consumer reporting agency shall - 


(i) send confirmation of the placement to the consumer; and 
(ii) inform the consumer of - 


(1) the process by which the consumer may remove the 
security freeze, including a mechanism to authenticate 
the consumer; and 


(II) the consumer’s right described in section 615(d)(1)(D). 


Notice to third parties. A consumer reporting agency may 
advise a third party that a security freeze has been placed with 
respect to a consumer under subparagraph (A). 


(3) Removal of security freeze. 


(A) 


(B) 


In general. A consumer reporting agency shall remove a 
security freeze placed on the consumer report of a consumer 
only in the following cases: 


(i) Upon the direct request of the consumer. 


(ii) The security freeze was placed due to a material 
misrepresentation of fact by the consumer. 


Notice if removal not by request. If a consumer reporting 
agency removes a security freeze under subparagraph (A)(ii), 
the consumer reporting agency shall notify the consumer in 
writing prior to removing the security freeze. 
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(C) 


(D) 


(E) 


Removal of security freeze by consumer request. Except as 
provided in subparagraph (A)(ii), a security freeze shall remain 
in place until the consumer directly requests that the security 
freeze be removed. Upon receiving a direct request from a 
consumer that a consumer reporting agency remove a security 
freeze, and upon receiving proper identification from the 
consumer, the consumer reporting agency shall, free of charge, 
remove the security freeze not later than - 


(i) in the case of a request that is by toll-free telephone or 
secure electronic means, 1 hour after receiving the request 
for removal; or 


(ii) in the case of a request that is by mail, 3 business days 
after receiving the request for removal. 


Third-party requests. If a third party requests access to a con- 
sumer report of a consumer with respect to which a security 
freeze is in effect, where such request is in connection with an 
application for credit, and the consumer does not allow such 
consumer report to be accessed, the third party may treat the 
application as incomplete. 


Temporary removal of security freeze. Upon receiving a direct 
request from a consumer under subparagraph (A)(i), if the 
consumer requests a temporary removal of a security freeze, 
the consumer reporting agency shall, in accordance with 
subparagraph (C), remove the security freeze for the period of 
time specified by the consumer. 


(4) Exceptions. A security freeze shall not apply to the making of a 
consumer report for use of the following: 


(A) 


A person or entity, or a subsidiary, affiliate, or agent of that 
person or entity, or an assignee of a financial obligation owed 
by the consumer to that person or entity, or a prospective 
assignee of a financial obligation owed by the consumer to that 
person or entity in conjunction with the proposed purchase of 
the financial obligation, with which the consumer has or had 
prior to assignment an account or contract including a demand 
deposit account, or to whom the consumer issued a negotiable 
instrument, for the purposes of reviewing the account or 
collecting the financial obligation owed for the account, 
contract, or negotiable instrument. For purposes of this 
subparagraph, ‘reviewing the account’ includes activities related 
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to account maintenance, monitoring, credit line increases, and 
account upgrades and enhancements. 


Any Federal, State, or local agency, law enforcement agency, 
trial court, or private collection agency acting pursuant to a 
court order, warrant, or subpoena. 


A child support agency acting pursuant to part D of title IV of 
the Social Security Act (42 U.S.C. 651 et seq.). 


A Federal agency or a State or its agents or assigns acting to 
investigate fraud or acting to investigate or collect delinquent 
taxes or unpaid court orders or to fulfill any of its other 
statutory responsibilities, provided such responsibilities are 
consistent with a permissible purpose under section 604. 


By a person using credit information for the purposes described 
under section 604(c). 


Any person or entity administering a credit file monitoring 
subscription or similar service to which the consumer has 
subscribed. 


Any person or entity for the purpose of providing a consumer 
with a copy of the consumer’s consumer report or credit score, 
upon the request of the consumer. 


Any person using the information in connection with the 
underwriting of insurance. 


Any person using the information for employment, tenant, or 
background screening purposes. 


Any person using the information for assessing, verifying, or 
authenticating a consumer’s identity for purposes other than the 
granting of credit, or for investigating or preventing actual or 
potential fraud. 


Notice of rights. At any time a consumer is required to receive a 
summary of rights required under section 609, the following notice 
shall be included: 


“CONSUMERS HAVE THE RicHt To OsTAIN A SECURITY FREEZE 


“You have a right to place a ‘security freeze’ on your credit report, 
which will prohibit a consumer reporting agency from releasing 
information in your credit report without your express authorization. 
The security freeze is designed to prevent credit, loans, and services 
from being approved in your name without your consent. However, 
you should be aware that using a security freeze to take control over 
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who gets access to the personal and financial information in your 
credit report may delay, interfere with, or prohibit the timely 
approval of any subsequent request or application you make 
regarding a new loan, credit, mortgage, or any other account 
involving the extension of credit. 
“As an alternative to a security freeze, you have the right to place an 
initial or extended fraud alert on your credit file at no cost. An initial 
fraud alert is a 1-year alert that is placed on a consumer’s credit file. 
Upon seeing a fraud alert display on a consumer’s credit file, a 
business is required to take steps to verify the consumer’s identity before 
extending new credit. If you are a victim of identity theft, you are 
entitled to an extended fraud alert, which is a fraud alert lasting 7 years. 
“A security freeze does not apply to a person or entity, or its 
affiliates, or collection agencies acting on behalf of the person or 
entity, with which you have an existing account that requests 
information in your credit report for the purposes of reviewing or 
collecting the account. Reviewing the account includes activities 
related to account maintenance, monitoring, credit line increases, 
and account upgrades and enhancements.” 
(6) Webpage. 
(A) Consumer reporting agencies. A consumer reporting agency 
shall establish a webpage that - 
(i) allows a consumer to request a security freeze; 
(ii) allows a consumer to request an initial fraud alert; 
(iii) allows a consumer to request an extended fraud alert; 
(iv) allows a consumer to request an active duty fraud alert; 
(v) allows a consumer to opt-out of the use of information in 
a consumer report to send the consumer a solicitation of 
credit or insurance, in accordance with section 615(d); and 
(vi) shall not be the only mechanism by which a consumer 
may request a security freeze. 


(B) FTC. The Federal Trade Commission shall establish a single 
webpage that includes a link to each webpage established under 
subparagraph (A) within the Federal Trade Commission’s 
website www.IdentityTheft.gov, or a successor website. 


(j) National protection for files and credit records of protected consumers. 
(1) Definitions. As used in this subsection: 


(A) The term ‘consumer reporting agency’ means a consumer 
reporting agency described in section 603(p). 


(B) The term ‘protected consumer’ means an individual who is - 
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(i) under the age of 16 years at the time a request for the 
placement of a security freeze is made; or 


(ii) an incapacitated person or a protected person for whom a 
guardian or conservator has been appointed. 


The term “protected consumer’s representative’ means a person 
who provides to a consumer reporting agency sufficient proof 
of authority to act on behalf of a protected consumer. 


The term ‘record’ means a compilation of information that - 
(i) identifies a protected consumer; 


(ii) is created by a consumer reporting agency solely for the 
purpose of complying with this subsection; and 


(iii) may not be created or used to consider the protected 
consumer’s credit worthiness, credit standing, credit 
capacity, character, general reputation, personal 
characteristics, or mode of living. 


The term ‘security freeze’ means a restriction that prohibits a 
consumer reporting agency from disclosing the contents of a 
consumer report that is the subject of such security freeze or, 
in the case of a protected consumer for whom the consumer 
reporting agency does not have a file, a record that is subject 
to such security freeze to any person requesting the consumer 
report for the purpose of opening a new account involving the 
extension of credit. 


The term ‘sufficient proof of authority’ means documentation 
that shows a protected consumer’s representative has authority 
to act on behalf of a protected consumer and includes - 


(i) an order issued by a court of law; 
(ii) a lawfully executed and valid power of attorney; 


(iii) a document issued by a Federal, State, or local government 
agency in the United States showing proof of parentage, 
including a birth certificate; or 


(iv) with respect to a protected consumer who has been placed 
in a foster care setting, a written communication from a 
county welfare department or its agent or designee, or 
a county probation department or its agent or designee, 
certifying that the protected consumer is in a foster care 
setting under its jurisdiction. 
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(G) 


The term ‘sufficient proof of identification’ means information 
or documentation that identifies a protected consumer and a 
protected consumer’s representative and includes - 


(i) asocial security number or a copy of a social security 
card issued by the Social Security Administration; 
S. 2155—36 


(ii) acertified or official copy of a birth certificate issued by 
the entity authorized to issue the birth certificate; or 


(ii) a copy of a driver’s license, an identification card issued 
by the motor vehicle administration, or any other 
government issued identification. 


(2) Placement of security freeze for a protected consumer. 


(A) 


(B) 


(C) 


In general. Upon receiving a direct request from a protected 
consumer’s representative that a consumer reporting agency 
place a security freeze, and upon receiving sufficient proof of 
identification and sufficient proof of authority, the consumer 
reporting agency shall, free of charge, place the security freeze 
not later than - 


(i) in the case of a request that is by toll-free telephone or 
secure electronic means, 1 business day after receiving 
the request directly from the protected consumer’s 
representative; or 


(ii) in the case of a request that is by mail, 3 business days 
after receiving the request directly from the protected 
consumer’s representative. 

Confirmation and additional information. 


Not later than 5 business days after placing a security freeze 
under subparagraph (A), a consumer reporting agency shall - 


(i) send confirmation of the placement to the protected 
consumer’s representative; and 


(ii) inform the protected consumer’s representative of the 
process by which the protected consumer may remove the 
security freeze, including a mechanism to authenticate the 
protected consumer’s representative. 


Creation of file. If a consumer reporting agency does not have 
a file pertaining to a protected consumer when the consumer 
reporting agency receives a direct request under subparagraph 
(A), the consumer reporting agency shall create a record for the 
protected consumer. 
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(3) Prohibition on release of record or file of protected consumer. After 

a security freeze has been placed under paragraph (2)(A), and unless 

the security freeze is removed in accordance with this subsection, a 
consumer reporting agency may not release the protected consumer’s 
consumer report, any information derived from the protected consumer’s 
consumer report, or any record created for the protected consumer. 


(4) 


Removal of a protected consumer security freeze. 


(A) Jn general. A consumer reporting agency shall remove a 


(B) 


(C) 


security freeze placed on the consumer report of a protected 
consumer only in the following cases: 


(i) Upon the direct request of the protected consumer’s 
representative. 


(ii) Upon the direct request of the protected consumer, if the 
protected consumer is not under the age of 16 years at the 
time of the request. 


(iii) The security freeze was placed due to a material 
misrepresentation of fact by the protected consumer’s 
representative. 


Notice if removal not by request. If a consumer reporting 
agency removes a security freeze under subparagraph (A)(iii), 
the consumer reporting agency shall notify the protected 
consumer’s representative in writing prior to removing the 
security freeze. 


Removal of freeze by request. Except as provided in 
subparagraph (A)(iii), a security freeze shall remain in place 
until a protected consumer’s representative or protected 
consumer described in subparagraph (A)(ii) directly requests 
that the security freeze be removed. Upon receiving a direct 
request from the protected consumer’s representative or 
protected consumer described in subparagraph (A)(ii) that a 
consumer reporting agency remove a security freeze, and upon 
receiving sufficient proof of identification and sufficient proof 
of authority, the consumer reporting agency shall, free of 
charge, remove the security freeze not later than - 


(i) in the case of a request that is by toll-free telephone or 
secure electronic means, 1 hour after receiving the request 
for removal; or 
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(ii) in the case of a request that is by mail, 3 business days 
after receiving the request for removal. 


(D) Temporary removal of security freeze. Upon receiving a direct 
request from a protected consumer or a protected consumer’s 
representative under subparagraph (A)(i), if the protected 
consumer or protected consumer’s representative requests a 
temporary removal of a security freeze, the consumer reporting 
agency shall, in accordance with subparagraph (C), remove the 
security freeze for the period of time specified by the protected 
consumer or protected consumer’s representative. 


(k) Credit monitoring. 


(1) Definitions. In this subsection: 


(2) 


(A) The term ‘active duty military consumer’ includes a member of 
the National Guard. 


(B) The term ‘National Guard’ has the meaning given the term in 
section 101(c) of title 10, United States Code. 


Credit monitoring. A consumer reporting agency described in section 
603(p) shall provide a free electronic credit monitoring service that, 
at a minimum, notifies a consumer of material additions or modifica- 
tions to the file of the consumer at the consumer reporting agency to 
any consumer who provides to the consumer reporting agency - 


(A) appropriate proof that the consumer is an active duty military 
consumer; and 


(B) contact information of the consumer. 


(3) Rulemaking. Not later than 1 year after the date of enactment of this 


subsection, the Federal Trade Commission shall promulgate 
regulations regarding the requirements of this subsection, which 
shall at a minimum include - 


(A) a definition of an electronic credit monitoring service and 
material additions or modifications to the file of a consumer; and 


(B) what constitutes appropriate proof. 


(4) Applicability. 


(A) Sections 616 and 617 shall not apply to any violation of this 
subsection. 

(B) This subsection shall be enforced exclusively under section 
621 by the Federal agencies and Federal and State officials 
identified in that section. 
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§ 605B. Block of information resulting from identity theft 


[15 U.S.C. § 1681¢-2] 


(a) Block. Except as otherwise provided in this section, a consumer reporting 
agency shall block the reporting of any information in the file of a 
consumer that the consumer identifies as information that resulted from 
an alleged identity theft, not later than 4 business days after the date of 
receipt by such agency of - 


(b) 


(c) 


(1) 
(2) 
(3) 
(4) 


appropriate proof of the identity of the consumer; 
a copy of an identity theft report; 
the identification of such information by the consumer; and 


a statement by the consumer that the information is not information 
relating to any transaction by the consumer. 


Notification. A consumer reporting agency shall promptly notify the 
furnisher of information identified by the consumer under subsection (a) - 


(1) 
(2) 
(3) 
(4) 


that the information may be a result of identity theft; 
that an identity theft report has been filed; 

that a block has been requested under this section; and 
of the effective dates of the block. 


Authority to Decline or Rescind 


(1) 


(2) 


(3) 


In general. A consumer reporting agency may decline to block, or may 
rescind any block, of information relating to a consumer under this 
section, if the consumer reporting agency reasonably determines that - 


(A) _ the information was blocked in error or a block was requested 
by the consumer in error; 


(B) _ the information was blocked, or a block was requested by the 
consumer, on the basis of a material misrepresentation of fact 
by the consumer relevant to the request to block; or 


(C) the consumer obtained possession of goods, services, or money 
as a result of the blocked transaction or transactions. 


Notification to consumer. If a block of information is declined or 
rescinded under this subsection, the affected consumer shall be 
notified promptly, in the same manner as consumers are notified of 
the reinsertion of information under section 611(a)(5)(B). 


Significance of block. For purposes of this subsection, if a consumer 
reporting agency rescinds a block, the presence of information in the 
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file of a consumer prior to the blocking of such information is not 
evidence of whether the consumer knew or should have known that 
the consumer obtained possession of any goods, services, or money 
as a result of the block. 


(d) Exception for Resellers 


(e) 


(1) 


(2) 


(3) 


No reseller file. This section shall not apply to a consumer reporting 
agency, if the consumer reporting agency - 


(A) is a reseller; 


(B) is not, at the time of the request of the consumer under sub- 
section (a), otherwise furnishing or reselling a consumer report 
concerning the information identified by the consumer; and 


(C) informs the consumer, by any means, that the consumer may 
report the identity theft to the Bureau to obtain consumer 
information regarding identity theft. 


Reseller with file. The sole obligation of the consumer reporting 
agency under this section, with regard to any request of a consumer 
under this section, shall be to block the consumer report maintained 
by the consumer reporting agency from any subsequent use, if - 


(A) the consumer, in accordance with the provisions of subsection 
(a), identifies, to a consumer reporting agency, information in 
the file of the consumer that resulted from identity theft; and 


(B) the consumer reporting agency is a reseller of the identified 
information. 


Notice. In carrying out its obligation under paragraph (2), the 
reseller shall promptly provide a notice to the consumer of the 
decision to block the file. Such notice shall contain the name, 
address, and telephone number of each consumer reporting agency 
from which the consumer information was obtained for resale. 


Exception for verification companies. The provisions of this section do not 
apply to a check services company, acting as such, which issues 
authorizations for the purpose of approving or processing negotiable 
instruments, electronic fund transfers, or similar methods of payments, 
except that, beginning 4 business days after receipt of information 
described in paragraphs (1) through (3) of subsection (a), a check services 
company shall not report to a national consumer reporting agency 
described in section 603(p), any information identified in the subject 
identity theft report as resulting from identity theft. 
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Access to blocked information by law enforcement agencies. No provision 
of this section shall be construed as requiring a consumer reporting agency 
to prevent a Federal, State, or local law enforcement agency from 
accessing blocked information in a consumer file to which the agency 
could otherwise obtain access under this title. 


§ 605C. Adverse information in cases of trafficking 


(a) 


(b) 


(c) 


[15 U.S.C. § 1681c-3] 
Definitions. Yn this section: 


(1) Trafficking documentation. The term “trafficking documentation” 
means- 


(A) documentation of- 


(i) a determination that a consumer is a victim of trafficking 
made by a Federal, State, or Tribal governmental entity; 
or 


(ii) by a court of competent jurisdiction; and 


(B) documentation that identifies items of adverse information 
that should not be furnished by a consumer reporting agency 
because the items resulted from a severe form of trafficking in 
persons or sex trafficking of which the consumer is a victim. 


(2) Trafficking Victims Protection Act of 2000 definitions. The terms 
“severe forms of trafficking in persons” and “sex trafficking” have 
the meanings given, respectively, in section 103 of the Trafficking 
Victims Protection Act of 2000 (22 U.S.C. 7102). 


(3) Victim of trafficking. The term “victim of trafficking” means a person 
who is a victim of a severe form of trafficking in persons or sex 
trafficking. 


Adverse information. A consumer reporting agency may not furnish a 
consumer report containing any adverse item of information about a 
consumer that resulted from a severe form of trafficking in persons or sex 
trafficking if the consumer has provided trafficking documentation to the 
consumer reporting agency. 


Rulemaking. 


(1) Jn general. Not later than 180 days after December 27, 2021, the 
Director shall issue rules to implement subsection (a). 


(2) Contents. The rules issued pursuant to paragraph (1) shall establish a 
method by which consumers shall submit trafficking documentation 
to consumer reporting agencies. 
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§ 606. Disclosure of investigative consumer reports 


[15 U.S.C. § 1681d] 


(a) Disclosure of fact of preparation. A person may not procure or cause to 


(b) 


(c) 


(d) 


be prepared an investigative consumer report on any consumer unless 


(1) it is clearly and accurately disclosed to the consumer that an 
investigative consumer report including information as to his 
character, general reputation, personal characteristics and mode of 
living, whichever are applicable, may be made, and such disclosure 


(A) is made in a writing mailed, or otherwise delivered, to the 
consumer, not later than three days after the date on which the 
report was first requested, and 


(B) includes a statement informing the consumer of his right to request 
the additional disclosures provided for under subsection (b) of this 
section and the written summary of the rights of the consumer 
prepared pursuant to section 609(c) [§ 1681g]; and 


(2) the person certifies or has certified to the consumer reporting agency that 


(A) _ the person has made the disclosures to the consumer required by 
paragraph (1); and 


(B) _ the person will comply with subsection (b). 


Disclosure on request of nature and scope of investigation. Any person 

who procures or causes to be prepared an investigative consumer report on 
any consumer shall, upon written request made by the consumer within a 
reasonable period of time after the receipt by him of the disclosure required 
by subsection (a)(1) of this section, make a complete and accurate disclosure 
of the nature and scope of the investigation requested. This disclosure shall be 
made in a writing mailed, or otherwise delivered, to the consumer not later 
than five days after the date on which the request for such disclosure was 
received from the consumer or such report was first requested, whichever is 
the later. 


Limitation on liability upon showing of reasonable procedures for compliance 

with provisions. No person may be held liable for any violation of subsection 

(a) or (b) of this section if he shows by a preponderance of the evidence that 

at the time of the violation he maintained reasonable procedures to assure 

compliance with subsection (a) or (b) of this section. 

Prohibitions 

(1) Certification. A consumer reporting agency shall not prepare or 
furnish investigative consumer report unless the agency has received 
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a certification under subsection (a)(2) from the person who requested 
the report. 


(2) Inquiries. A consumer reporting agency shall not make an inquiry for 
the purpose of preparing an investigative consumer report on a consumer 
for employment purposes if the making of the inquiry by an employer 
or prospective employer of the consumer would violate any applicable 
Federal or State equal employment opportunity law or regulation. 


(3) Certain public record information. Except as otherwise provided in 
section 613 [§ 1681k], a consumer reporting agency shall not furnish 
an investigative consumer report that includes information that is a 
matter of public record and that relates to an arrest, indictment, 
conviction, civil judicial action, tax lien, or outstanding judgment, 
unless the agency has verified the accuracy of the information during 
the 30-day period ending on the date on which the report is furnished. 


(4) Certain adverse information. A consumer reporting agency shall not 
prepare or furnish an investigative consumer report on a consumer 
that contains information that is adverse to the interest of the 
consumer and that is obtained through a personal interview with a 
neighbor, friend, or associate of the consumer or with another person 
with whom the consumer is acquainted or who has knowledge of such 
item of information, unless 


(A) the agency has followed reasonable procedures to obtain 
confirmation of the information, from an additional source that 
has independent and direct knowledge of the information; or 


(B) the person interviewed is the best possible source of the 
information. 


§ 607. Compliance procedures [15 U.S.C. § 1681e] 


(a) Identity and purposes of credit users. Every consumer reporting agency 
shall maintain reasonable procedures designed to avoid violations of 
section 605 [§ 1681c] and to limit the furnishing of consumer reports to 
the purposes listed under section 604 [§ 1681b] of this title. These 
procedures shall require that prospective users of the information identify 
themselves, certify the purposes for which the information is sought, 
and certify that the information will be used for no other purpose. Every 
consumer reporting agency shall make a reasonable effort to verify the 
identity of a new prospective user and the uses certified by such 
prospective user prior to furnishing such user a consumer report. No 
consumer reporting agency may furnish a consumer report to any person 
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(b) 


(c) 


(d) 


(e) 


if it has reasonable grounds for believing that the consumer report will not 
be used for a purpose listed in section 604 [§ 1681b] of this title. 


Accuracy of report. Whenever a consumer reporting agency prepares a 
consumer report it shall follow reasonable procedures to assure maximum 
possible accuracy of the information concerning the individual about 
whom the report relates. 


Disclosure of consumer reports by users allowed. A consumer reporting 
agency may not prohibit a user of a consumer report furnished by the 
agency on a consumer from disclosing the contents of the report to the 
consumer, if adverse action against the consumer has been taken by the 
user based in whole or in part on the report. 


Notice to Users and Furnishers of Information 


(1) Notice requirement. A consumer reporting agency shall provide to 
any person 


(A) who regularly and in the ordinary course of business furnishes 
information to the agency with respect to any consumer; or 


(B) to whom a consumer report is provided by the agency; a notice 
of such person’s responsibilities under this title. 


See also 12 CFR Part 1022, App M-N 


(2) Content of notice. The Bureau shall prescribe the content of notices 
under paragraph (1), and a consumer reporting agency shall be 
in compliance with this subsection if it provides a notice under 
paragraph (1) that is substantially similar to the Bureau prescription 
under this paragraph. 


Procurement of Consumer Report for Resale 


(1) Disclosure. A person may not procure a consumer report for 
purposes of reselling the report (or any information in the report) 
unless the person discloses to the consumer reporting agency that 
originally furnishes the report 


(A) _ the identity of the end-user of the report (or information); and 


(B) each permissible purpose under section 604 [§ 1681b] for 
which the report is furnished to the end-user of the report 
(or information). 


(2) Responsibilities of procurers for resale. A person who procures a 
consumer report for purposes of reselling the report (or any 
information in the report) shall 
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(A) establish and comply with reasonable procedures designed to 


(B) 


ensure that the report (or information) is resold by the person 
only for a purpose for which the report may be furnished under 
section 604 [§ 1681b], including by requiring that each person 
to which the report (or information) is resold and that resells or 
provides the report (or information) to any other person 


(i) identifies each end user of the resold report 
(or information); 


(ii) certifies each purpose for which the report 
(or information) will be used; and 


(iii) certifies that the report (or information) will be used for 
no other purpose; and 


before reselling the report, make reasonable efforts to verify the 
identifications and certifications made under subparagraph (A). 


(3) Resale of consumer report to a federal agency or department. 
Notwithstanding paragraph (1) or (2), a person who procures 
a consumer report for purposes of reselling the report (or any 
information in the report) shall not disclose the identity of the 
end-user of the report under paragraph (1) or (2) if - 


(A) the end user is an agency or department of the United States 


(B) 


Government which procures the report from the person for 
purposes of determining the eligibility of the consumer 
concerned to receive access or continued access to classified 
information (as defined in section 604(b)(4)(E)(i)); and 


the agency or department certifies in writing to the person 
reselling the report that nondisclosure is necessary to protect 
classified information or the safety of persons employed by or 
contracting with, or undergoing investigation for work or 
contracting with the agency or department. 


§ 608. Disclosures to governmental agencies [15 U.S.C. § 1681f] 


Notwithstanding the provisions of section 604 [§ 1681b] of this title, a 
consumer reporting agency may furnish identifying information respecting 
any consumer, limited to his name, address, former addresses, places of 
employment, or former places of employment, to a governmental agency. 
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§ 609. Disclosures to consumers [15 U.S.C. § 1681g] 


(a) Information on file; sources; report recipients. Every consumer reporting 
agency shall, upon request, and subject to 610(a)(1) [§ 1681h], clearly and 
accurately disclose to the consumer: 


(1) 


(2) 


(3) 


All information in the consumer’s file at the time of the request 
except that — 


(A) if the consumer to whom the file relates requests that the first 
5 digits of the social security number (or similar identification 
number) of the consumer not be included in the disclosure and 
the consumer reporting agency has received appropriate proof 
of the identity of the requester, the consumer reporting agency 
shall so truncate such number in such disclosure; and 


(B) nothing in this paragraph shall be construed to require a 
consumer reporting agency to disclose to a consumer any 
information concerning credit scores or any other risk scores or 
predictors relating to the consumer. 


The sources of the information; except that the sources of information 
acquired solely for use in preparing an investigative consumer report 
and actually use for no other purpose need not be disclosed: 
Provided, That in the event an action is brought under this title, such 
sources shall be available to the plaintiff under appropriate discovery 
procedures in the court in which the action is brought. 


(A) Identification of each person (including each end-user identified 
under section 607(e)(1) [§ 1681e]) that procured a consumer report 


(i) for employment purposes, during the 2-year period 
preceding the date on which the request is made; or 


(ii) for any other purpose, during the 1-year period preceding 
the date on which the request is made. 


(B) An identification of a person under subparagraph (A) shall 
include 


(i) _ the name of the person or, if applicable, the trade name 
(written in full) under which such person conducts 
business; and 


(ii) upon request of the consumer, the address and telephone 
number of the person. 


(C) Subparagraph (A) does not apply if - 
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the end user is an agency or department of the United 
States Government that procures the report from the 
person for purposes of determining the eligibility of the 
consumer to whom the report relates to receive access or 
continued access to classified information (as defined in 
section 604(b)(4)(E)(i)); and 


the head of the agency or department makes a written 
finding as prescribed under section 604(b)(4)(A). 


(4) The dates, original payees, and amounts of any checks upon which is 
based any adverse characterization of the consumer, included in the 
file at the time of the disclosure. 


(5) A record of all inquiries received by the agency during the 1-year 
period preceding the request that identified the consumer in 
connection with a credit or insurance transaction that was not initiated 
by the consumer. 


(6) If the consumer requests the credit file and not the credit score, a 
statement that the consumer may request and obtain a credit score. 


Exempt information. The requirements of subsection (a) of this section 
respecting the disclosure of sources of information and the recipients 

of consumer reports do not apply to information received or consumer 
reports furnished prior to the effective date of this title except to the extent 
that the matter involved is contained in the files of the consumer reporting 
agency on that date. 


Summary of Rights to Obtain and Dispute Information in Consumer 
Reports and to Obtain Credit Scores 


See also 12 CFR Part 1022, App K 


(1) Bureau Summary of Rights Required 


(A) Jn general. The Bureau shall prepare a model summary of the 
rights of consumers under this title. 


(B) 


Content of summary. The summary of rights prepared under 
subparagraph (A) shall include a description of - 


(i) 


(ii) 


the right of a consumer to obtain a copy of a consumer 
report under subsection (a) from each consumer reporting 
agency; 

the frequency and circumstances under which a consumer 
is entitled to receive a consumer report without charge 
under section 612; 
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(2) 


(iii) the right of a consumer to dispute information in the file 
of the consumer under section 611; 


(iv) the right of a consumer to obtain a credit score from a 
consumer reporting agency, and a description of how to 
obtain a credit score; 


(v) the method by which a consumer can contact, and obtain a 
consumer report from, a consumer reporting agency 
without charge, as provided in the regulations of the 
Bureau prescribed under section 211(c) of the Fair and 
Accurate Credit Transactions Act of 2003; and 


(vi) the method by which a consumer can contact, and obtain 
a consumer report from, a consumer reporting agency 
described in section 603(w), as provided in the regulations 
of the Bureau prescribed under section 612(a)(1)(C). 


(C) Availability of summary of rights. The Bureau shall - 


(i) actively publicize the availability of the summary of rights 
prepared under this paragraph; 


(ii) conspicuously post on its Internet website the availability 
of such summary of rights; and 


(ii) promptly make such summary of rights available to 
consumers, on request. 


Summary of rights required to be included with agency disclosures. 
A consumer reporting agency shall provide to a consumer, with each 
written disclosure by the agency to the consumer under this section - 


(A) the summary of rights prepared by the Bureau under paragraph (1); 


(B) in the case of a consumer reporting agency described in section 
603(p), a toll-free telephone number established by the agency, 
at which personnel are accessible to consumers during normal 
business hours; 


(C) alist of all Federal agencies responsible for enforcing any 
provision of this title, and the address and any appropriate 
phone number of each such agency, in a form that will assist 
the consumer in selecting the appropriate agency; 


(D) a statement that the consumer may have additional rights under 
State law, and that the consumer may wish to contact a State or 
local consumer protection agency or a State attorney general 
(or the equivalent thereof) to learn of those rights; and 
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(E) astatement that a consumer reporting agency is not required 
to remove accurate derogatory information from the file of a 
consumer, unless the information is outdated under section 605 
or cannot be verified. 


(d) Summary of Rights of Identity Theft Victims 


(1) 


(2) 


See also 12 CFR Part 1022, App I 


In general. The Bureau, in consultation with the Federal banking 
agencies and the National Credit Union Administration, shall prepare 
a model summary of the rights of consumers under this title with 
respect to the procedures for remedying the effects of fraud or identity 
theft involving credit, an electronic fund transfer, or an account or 
transaction at or with a financial institution or other creditor. 


Summary of rights and contact information. Beginning 60 days after the 
date on which the model summary of rights is prescribed in final form 
by the Bureau pursuant to paragraph (1), if any consumer contacts a 
consumer reporting agency and expresses a belief that the consumer is 
a victim of fraud or identity theft involving credit, an electronic fund 
transfer, or an account or transaction at or with a financial institution 
or other creditor, the consumer reporting agency shall, in addition to 
any other action that the agency may take, provide the consumer with 
a summary of rights that contains all of the information required by 
the Bureau under paragraph (1), and information on how to contact the 
Bureau to obtain more detailed information. 


(e) Information Available to Victims 


(1) 


In general. For the purpose of documenting fraudulent transactions 
resulting from identity theft, not later than 30 days after the date of 
receipt of a request from a victim in accordance with paragraph (3), 
and subject to verification of the identity of the victim and the claim 
of identity theft in accordance with paragraph (2), a business entity 
that has provided credit to, provided for consideration products, 
goods, or services to, accepted payment from, or otherwise entered 
into a commercial transaction for consideration with, a person who 
has allegedly made unauthorized use of the means of identification of 
the victim, shall provide a copy of application and business transaction 
records in the control of the business entity, whether maintained by 
the business entity or by another person on behalf of the business 
entity, evidencing any transaction alleged to be a result of identity 
theft to - 


(A) | the victim; 
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(B) 


(C) 


any Federal, State, or local government law enforcement 
agency or officer specified by the victim in such a request; or 


Any law enforcement agency investigating the identity theft 
and authorized by the victim to take receipt of records provided 
under this subsection. 


(2) Verification of identity and claim. Before a business entity provides 
any information under paragraph (1), unless the business entity, at its 
discretion, otherwise has a high degree of confidence that it knows 
the identity of the victim making a request under paragraph (1), the 
victim shall provide to the business entity - 


(A) 


(B) 


as proof of positive identification of the victim, at the election 
of the business entity - 


(i) _ the presentation of a government-issued identification card; 


(ii) personally identifying information of the same type as was 
provided to the business entity by the unauthorized 
person; or 


(iii) personally identifying information that the business entity 
typically requests from new applicants or for new 
transactions, at the time of the victim’s request for 
information, including any documentation described in 
clauses (i) and (ii); and 


as proof of a claim of identity theft, at the election of the 
business entity - 


(i) acopy of a police report evidencing the claim of the 
victim of identity theft; and 


(ii) a properly completed - 


(1) copy of a standardized affidavit of identity theft 
developed and made available by the Bureau; or 


(I) an affidavit of fact that is acceptable to the business 
entity for that purpose. 


(3) Procedures. The request of a victim under paragraph (1) shall - 


(A) 
(B) 
(C) 


be in writing; 
be mailed to an address specified by the business entity, if any; and 


if asked by the business entity, include relevant information 
about any transaction alleged to be a result of identity theft to 
facilitate compliance with this section including - 
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(i) if known by the victim (or if readily obtainable by the 
victim), the date of the application or transaction; and 


(ii) if known by the victim (or if readily obtainable by the 
victim), any other identifying information such as an 
account or transaction number. 


No charge to victim. Information required to be provided under para- 
graph (1) shall be so provided without charge. 


Authority to decline to provide information. A business entity may 
decline to provide information under paragraph (1) if, in the exercise 
of good faith, the business entity determines that - 


(A) _ this subsection does not require disclosure of the information; 


(B) after reviewing the information provided pursuant to paragraph 
(2), the business entity does not have a high degree of 
confidence in knowing the true identity of the individual 
requesting the information; 


(C) the request for the information is based on a misrepresentation 
of fact by the individual requesting the information relevant to 
the request for information; or 


(D the information requested is Internet navigational data or similar 
information about a person’s visit to a website or online service. 


Limitation on liability. Except as provided in section 621, sections 
616 and 617 do not apply to any violation of this subsection. 


Limitation on civil liability. No business entity may be held civilly 
liable under any provision of Federal, State, or other law for 
disclosure, made in good faith pursuant to this subsection. 


No new recordkeeping obligation. Nothing in this subsection creates 
an obligation on the part of a business entity to obtain, retain, or 
maintain information or records that are not otherwise required to be 
obtained, retained, or maintained in the ordinary course of its 
business or under other applicable law. 


Rule of Construction 


(A) Jn general. No provision of subtitle A of title V of Public Law 
106-102, prohibiting the disclosure of financial information by 
a business entity to third parties shall be used to deny disclosure 
of information to the victim under this subsection. 


(B) Limitation. Except as provided in subparagraph (A), nothing 
in this subsection permits a business entity to disclose 
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(f) 


information, including information to law enforcement under 
subparagraphs (B) and (C) of paragraph (1), that the business 
entity is otherwise prohibited from disclosing under any other 
applicable provision of Federal or State law. 


(10) Affirmative defense. In any civil action brought to enforce this 
subsection, it is an affirmative defense (which the defendant must 
establish by a preponderance of the evidence) for a business entity to 
file an affidavit or answer stating that - 


(A) _ the business entity has made a reasonably diligent search of its 
available business records; and 


(B) the records requested under this subsection do not exist or are 
not reasonably available. 


(11) Definition of victim. For purposes of this subsection, the term 
“victim” means a consumer whose means of identification or 
financial information has been used or transferred (or has been 
alleged to have been used or transferred) without the authority of that 
consumer, with the intent to commit, or to aid or abet, an identity 
theft or a similar crime. 


(12) Effective date. This subsection shall become effective 180 days after 
the date of enactment of this subsection. 


(13) Effectiveness study. Not later than 18 months after the date of 
enactment of this subsection, the Comptroller General of the United 
States shall submit a report to Congress assessing the effectiveness of 
this provision. 


Disclosure of Credit Scores 


(1) Jn general. Upon the request of a consumer for a credit score, a 
consumer reporting agency shall supply to the consumer a statement 
indicating that the information and credit scoring model may be 
different than the credit score that may be used by the lender, and a 
notice which shall include - 


(A) the current credit score of the consumer or the most recent 
credit score of the consumer that was previously calculated by 
the credit reporting agency for a purpose related to the 
extension of credit; 


(B) the range of possible credit scores under the model used; 


(C) all of the key factors that adversely affected the credit score 
of the consumer in the model used, the total number of which 
shall not exceed 4, subject to paragraph (9); 
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(D) the date on which the credit score was created; and 


(E) the name of the person or entity that provided the credit score 
or credit file upon which the credit score was created. 


(2) Definitions. For purposes of this subsection, the following 
definitions shall apply: 


(A) The term “credit score” — 


(i) means a numerical value or a categorization derived from 
a Statistical tool or modeling system used by a person who 
makes or arranges a loan to predict the likelihood of certain 
credit behaviors, including default (and the numerical 
value or the categorization derived from such analysis 
may also be referred to as a “risk predictor” or “risk 
score”); and 


(ii) does not include — 


(1) any mortgage score or rating of an automated 
underwriting system that considers one or more 
factors in addition to credit information, including the 
loan to value ratio, the amount of down payment, or 
the financial assets of a consumer; or 


(I) any other elements of the underwriting process or 
underwriting decision. 


(B) The term “key factors” means all relevant elements or reasons 
adversely affecting the credit score for the particular individual, 
listed in the order of their importance based on their effect on 
the credit score. 


(3) Timeframe and manner of disclosure. The information required by 
this subsection shall be provided in the same timeframe and manner 
as the information described in subsection (a). 


(4) Applicability to certain uses. This subsection shall not be construed 
so as to compel a consumer reporting agency to develop or disclose a 
score if the agency does not - 


(A) distribute scores that are used in connection with residential real 
property loans; or 


(B) develop scores that assist credit providers in understanding the 
general credit behavior of a consumer and predicting the future 
credit behavior of the consumer. 


(5) Applicability to credit scores developed by another person. 
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(6) 


(7) 


(8) 


(9) 


(A) 


(B) 


In general. This subsection shall not be construed to require a 
consumer reporting agency that distributes credit scores 
developed by another person or entity to provide a further 
explanation of them, or to process a dispute arising pursuant 
to section 611, except that the consumer reporting agency shall 
provide the consumer with the name and address and website 
for contacting the person or entity who developed the score or 
developed the methodology of the score. 


Exception. This paragraph shall not apply to a consumer 
reporting agency that develops or modifies scores that are 
developed by another person or entity. 


Maintenance of credit scores not required. This subsection shall not 
be construed to require a consumer reporting agency to maintain 
credit scores in its files. 


Compliance in certain cases. In complying with this subsection, a 
consumer reporting agency shall - 


(A) 


(B) 


supply the consumer with a credit score that is derived from a 
credit scoring model that is widely distributed to users by that 
consumer reporting agency in connection with residential real 
property loans or with a credit score that assists the consumer 
in understanding the credit scoring assessment of the credit 
behavior of the consumer and predictions about the future credit 
behavior of the consumer; and 


a statement indicating that the information and credit scoring 
model may be different than that used by the lender. 


Fair and reasonable fee. A consumer reporting agency may charge a 
fair and reasonable fee, as determined by the Bureau, for providing 
the information required under this subsection. 


See also 69 Fed. Reg. 64698 (11/08/04) 


Use of enquiries as a key factor. If a key factor that adversely affects 
the credit score of a consumer consists of the number of enquiries 
made with respect to a consumer report, that factor shall be included 
in the disclosure pursuant to paragraph (1)(C) without regard to the 
numerical limitation in such paragraph. 


(g) Disclosure of Credit Scores by Certain Mortgage Lenders 


(1) Jn general. Any person who makes or arranges loans and who uses 
a consumer credit score, as defined in subsection (f), in connection 
with an application initiated or sought by a consumer for a closed end 
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loan or the establishment of an open end loan for a consumer purpose 
that is secured by 1 to 4 units of residential real property (hereafter in 
this subsection referred to as the “lender”) shall provide the following 
to the consumer as soon as reasonably practicable: 


(A) 


(B) 


(C) 


(D) 


Information Required under Subsection (f) 


(i) Jn general. A copy of the information identified in 
subsection (f) that was obtained from a consumer 
reporting agency or was developed and used by the user 
of the information. 


(ii) Notice under subparagraph (D). In addition to the 
information provided to it by a third party that provided 
the credit score or scores, a lender is only required to 
provide the notice contained in subparagraph (D). 


Disclosures in Case of Automated Underwriting System 


(i) Jn general. If a person that is subject to this subsection 
uses an automated underwriting system to underwrite a 
loan, that person may satisfy the obligation to provide a 
credit score by disclosing a credit score and associated key 
factors supplied by a consumer reporting agency. 


(ii) Numerical credit score. However, if a numerical credit 
score is generated by an automated underwriting system 
used by an enterprise, and that score is disclosed to the 
person, the score shall be disclosed to the consumer 
consistent with subparagraph (c). 


(iii) Enterprise defined. For purposes of this subparagraph, the 
term “enterprise” has the same meaning as in 
paragraph (6) of section 1303 of the Federal Housing 
Enterprises Financial Safety and Soundness Act of 1992. 


Disclosures of credit scores not obtained from a consumer 
reporting agency. A person that is subject to the provisions of 

this subsection and that uses a credit score, other than a credit 
score provided by a consumer reporting agency, may satisfy the 
obligation to provide a credit score by disclosing a credit score and 
associated key factors supplied by a consumer reporting agency. 


Notice to home loan applicants. A copy of the following notice, 
which shall include the name, address, and telephone number 
of each consumer reporting agency providing a credit score that 
was used: 
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“Notice To THE Home Loan APPLICANT 


“In connection with your application for a home loan, the lender must disclose 
to you the score that a consumer reporting agency distributed to users and the 
lender used in connection with your home loan, and the key factors affecting 
your credit scores. 


“The credit score is a computer generated summary calculated at the time of the 
request and based on information that a consumer reporting agency or lender 
has on file. The scores are based on data about your credit history and payment 
patterns. Credit scores are important because they are used to assist the lender 
in determining whether you will obtain a loan. They may also be used to 
determine what interest rate you may be offered on the mortgage. Credit scores 
can change over time, depending on your conduct, how your credit history and 
payment patterns change, and how credit scoring technologies change. 
“Because the score is based on information in your credit history, it is very 
important that you review the credit-related information that is being furnished to 
make sure it is accurate. Credit records may vary from one company to another. 
“If you have questions about your credit score or the credit information that 

is furnished to you, contact the consumer reporting agency at the address and 
telephone number provided with this notice, or contact the lender, if the lender 
developed or generated the credit score. The consumer reporting agency plays 
no part in the decision to take any action on the loan application and is unable 
to provide you with specific reasons for the decision on a loan application. 

“If you have questions concerning the terms of the loan, contact the lender.” 


(E) Actions not required under this subsection. This subsection 
shall not require any person to - 


(i) explain the information provided pursuant to subsection (f); 


Gi disclose any information other than a credit score or key 
factors, as defined in subsection (f); 


(iii) disclose any credit score or related information obtained 
by the user after a loan has closed; 


(iv) provide more than 1 disclosure per loan transaction; or 


(v) provide the disclosure required by this subsection when 
another person has made the disclosure to the consumer 
for that loan transaction. 


(F) No Obligation for Content 


(i) Jn general. The obligation of any person pursuant to this 
subsection shall be limited solely to providing a copy 
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of the information that was received from the consumer 
reporting agency. 

(ii) Limit on liability. No person has liability under this 
subsection for the content of that information or for the 
omission of any information within the report provided by 
the consumer reporting agency. 


Person defined as excluding enterprise. As used in this 
subsection, the term “person” does not include an enterprise (as 
defined in paragraph (6) of section 1303 of the Federal Housing 
Enterprises Financial Safety and Soundness Act of 1992). 


(2) Prohibition on Disclosure Clauses Null and Void 


(A) 


(B) 


In general. Any provision in a contract that prohibits the disclo- 
sure of a credit score by a person who makes or arranges loans 
or a consumer reporting agency is void. 

No liability for disclosure under this subsection. A lender shall 
not have liability under any contractual provision for disclosure 
of a credit score pursuant to this subsection. 


§ 610. Conditions and form of disclosure to consumers 
[15 U.S.C. § 1681h] 


In General 


(a) 


(b) 


(1) Proper identification. A consumer reporting agency shall require, 
as a condition of making the disclosures required under section 609 
[§ 1681g], that the consumer furnish proper identification. 


(2) Disclosure in writing. Except as provided in subsection (b), the 
disclosures required to be made under section 609 [§ 1681g] shall be 
provided under that section in writing. 


Other Forms of Disclosure 


(1) Jn general. If authorized by a consumer, a consumer reporting 
agency may make the disclosures required under 609 [§ 1681g] 


(A) 
(B) 


other than in writing; and 
in such form as may be 


(i) specified by the consumer in accordance with paragraph 
(2); and 


(ii) available from the agency. 


(2) Form. A consumer may specify pursuant to paragraph (1) that 
disclosures under section 609 [§ 1681g] shall be made 
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(c) 


(d) 


(e) 


(A) in person, upon the appearance of the consumer at the place of 
business of the consumer reporting agency where disclosures 
are regularly provided, during normal business hours, and on 
reasonable notice; 


(B) _ by telephone, if the consumer has made a written request for 
disclosure by telephone; 


(C) by electronic means, if available from the agency; or 
(D) _ by any other reasonable means that is available from the agency. 


Trained personnel. Any consumer reporting agency shall provide trained 
personnel to explain to the consumer any information furnished to him 
pursuant to section 609 [§ 1681g] of this title. 


Persons accompanying consumer. The consumer shall be permitted to be 
accompanied by one other person of his choosing, who shall furnish rea- 
sonable identification. A consumer reporting agency may require the con- 
sumer to furnish a written statement granting permission to the consumer 
reporting agency to discuss the consumer’s file in such person’s presence. 


Limitation of liability. Except as provided in sections 616 and 617 [§§ 
1681n and 16810] of this title, no consumer may bring any action or 
proceeding in the nature of defamation, invasion of privacy, or negligence 
with respect to the reporting of information against any consumer reporting 
agency, any user of information, or any person who furnishes information 
to a consumer reporting agency, based on information disclosed pursuant 
to section 609, 610, or 615 [§§ 1681g, 1681h, or 1681m] of this title or 
based on information disclosed by a user of a consumer report to or for a 
consumer against whom the user has taken adverse action, based in whole 
or in part on the report, except as to false information furnished with 
malice or willful intent to injure such consumer. 


§ 611. Procedure in case of disputed accuracy [15 U.S.C. § 1681] 


(a) 


Reinvestigations of Disputed Information 
(1) Reinvestigation Required 


(A) Jn general. Subject to subsection (f), and except as provided 
in subsection (g) if the completeness or accuracy of any item 
of information contained in a consumer’s file at a consumer 
reporting agency is disputed by the consumer and the consumer 
notifies the agency directly, or indirectly through a reseller, 
of such dispute, the agency shall, free of charge, conduct a 
reasonable reinvestigation to determine whether the disputed 
information is inaccurate and record the current status of the 
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disputed information, or delete the item from the file in 
accordance with paragraph (5), before the end of the 30-day 
period beginning on the date on which the agency receives the 
notice of the dispute from the consumer or reseller. 


Extension of period to reinvestigate. Except as provided in 
subparagraph (c), the 30-day period described in subparagraph 
(A) may be extended for not more than 15 additional days if 
the consumer reporting agency receives information from the 
consumer during that 30-day period that is relevant to the 
reinvestigation. 


Limitations on extension of period to reinvestigate. 
Subparagraph (B) shall not apply to any reinvestigation in 
which, during the 30-day period described in subparagraph 
(A), the information that is the subject of the reinvestigation is 
found to be inaccurate or incomplete or the consumer reporting 
agency determines that the information cannot be verified. 


(2) Prompt Notice of Dispute to Furnisher of Information 


(A) 


(B) 


In general. Before the expiration of the 5-business-day period 
beginning on the date on which a consumer reporting agency 
receives notice of a dispute from any consumer or a reseller in 
accordance with paragraph (1), the agency shall provide 
notification of the dispute to any person who provided any item 
of information in dispute, at the address and in the manner 
established with the person. The notice shall include all relevant 
information regarding the dispute that the agency has received 
from the consumer or reseller. 


Provision of other information. The consumer reporting agency 
shall promptly provide to the person who provided the 
information in dispute all relevant information regarding the 
dispute that is received by the agency from the consumer or 
the reseller after the period referred to in subparagraph (A) and 
before the end of the period referred to in paragraph (1)(A). 


(3) Determination That Dispute Is Frivolous or Irrelevant 


(A) 


In general. Notwithstanding paragraph (1), a consumer reporting 
agency may terminate a reinvestigation of information disputed by 
a consumer under that paragraph if the agency reasonably deter- 
mines that the dispute by the consumer is frivolous or irrelevant, 
including by reason of a failure by a consumer to provide 
sufficient information to investigate the disputed information. 
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(4) 


(5) 


(B) 


(C) 


Notice of determination. Upon making any determination in 
accordance with subparagraph (A) that a dispute is frivolous or 
irrelevant, a consumer reporting agency shall notify the 
consumer of such determination not later than 5 business days 
after making such determination, by mail or, if authorized by 
the consumer for that purpose, by any other means available to 
the agency. 


Contents of notice. A notice under subparagraph (B) shall include 


(i) the reasons for the determination under subparagraph (A); 
and 


(ii) identification of any information required to investigate 
the disputed information, which may consist of a standard- 
ized form describing the general nature of such informa- 
tion. 


Consideration of consumer information. In conducting any 
reinvestigation under paragraph (1) with respect to disputed 
information in the file of any consumer, the consumer reporting 
agency shall review and consider all relevant information submitted 
by the consumer in the period described in paragraph (1)(A) with 
respect to such disputed information. 


Treatment of Inaccurate or Unverifiable Information 


(A) 


(B) 


In general. If, after any reinvestigation under paragraph (1) of 
any information disputed by a consumer, an item of the 
information is found to be inaccurate or incomplete or cannot 
be verified, the consumer reporting agency shall - 


(i) promptly delete that item of information from the file of 
the consumer, or modify that item of information, as 
appropriate, based on the results of the reinvestigation; and 


Gi) promptly notify the furnisher of that information that the 
information has been modified or deleted from the file of 
the consumer. 


Requirements Relating to Reinsertion of Previously Deleted 
Material 


(i) Certification of accuracy of information. If any 
information is deleted from a consumer’s file pursuant to 
subparagraph (A), the information may not be reinserted 
in the file by the consumer reporting agency unless the 
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person who furnishes the information certifies that the 
information is complete and accurate. 


(ii) Notice to consumer. If any information that has been de- 
leted from a consumer’s file pursuant to subparagraph (A) 
is reinserted in the file, the consumer reporting agency 
shall notify the consumer of the reinsertion in writing 
not later than 5 business days after the reinsertion or, if 
authorized by the consumer for that purpose, by any other 
means available to the agency. 


(iii) Additional information. As part of, or in addition to, the 
notice under clause (ii), a consumer reporting agency shall 
provide to a consumer in writing not later than 5 business 
days after the date of the reinsertion 


(1) a statement that the disputed information has been 
reinserted; 


(II) the business name and address of any furnisher of 
information contacted and the telephone number of 
such furnisher, if reasonably available, or of any 
furnisher of information that contacted the consumer 
reporting agency, in connection with the reinsertion 
of such information; and 


(IIT) a notice that the consumer has the right to add a 
statement to the consumer’s file disputing the accuracy 
or completeness of the disputed information. 


(C) Procedures to prevent reappearance. A consumer reporting 
agency shall maintain reasonable procedures designed to 
prevent the reappearance in a consumer’s file, and in consumer 
reports on the consumer, of information that is deleted pursuant 
to this paragraph (other than information that is reinserted in 
accordance with subparagraph (B)(i)). 


(D) Automated reinvestigation system. Any consumer reporting 
agency that compiles and maintains files on consumers on a 
nationwide basis shall implement an automated system through 
which furnishers of information to that consumer reporting 
agency may report the results of a reinvestigation that finds 
incomplete or inaccurate information in a consumer’s file to 
other such consumer reporting agencies. 


(6) Notice of Results of Reinvestigation 
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(A) Jn general. A consumer reporting agency shall provide written 
notice to a consumer of the results of a reinvestigation under 
this subsection not later than 5 business days after the comple- 
tion of the reinvestigation, by mail or, if authorized by the con- 
sumer for that purpose, by other means available to the agency. 


(B) Contents. As part of, or in addition to, the notice under 
subparagraph (A), a consumer reporting agency shall provide to 
a consumer in writing before the expiration of the 5-day period 
referred to in subparagraph (A) 


(i) a statement that the reinvestigation is completed; 


(ii) aconsumer report that is based upon the consumer’s file 
as that file is revised as a result of the reinvestigation; 


(iii) a notice that, if requested by the consumer, a description 
of the procedure used to determine the accuracy and 
completeness of the information shall be provided to the 
consumer by the agency, including the business name and 
address of any furnisher of information contacted in 
connection with such information and the telephone 
number of such furnisher, if reasonably available; 


(iv) a notice that the consumer has the right to add a statement 
to the consumer’s file disputing the accuracy or complete- 
ness of the information; and 


(v) anotice that the consumer has the right to request under 
subsection (d) that the consumer reporting agency furnish 
notifications under that subsection. 


(7) Description of reinvestigation procedure. A consumer reporting 
agency shall provide to a consumer a description referred to in 
paragraph (6)(B)(iii) by not later than 15 days after receiving a 
request from the consumer for that description. 


(8) Expedited dispute resolution. If a dispute regarding an item of 
information in a consumer’s file at a consumer reporting agency is 
resolved in accordance with paragraph (5)(A) by the deletion of the 
disputed information by not later than 3 business days after the date 
on which the agency receives notice of the dispute from the consumer 
in accordance with paragraph (1)(A), then the agency shall not be 
required to comply with paragraphs (2), (6), and (7) with respect to 
that dispute if the agency 


(A) provides prompt notice of the deletion to the consumer by 
telephone; 
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(B) includes in that notice, or in a written notice that accompanies a 
confirmation and consumer report provided in accordance with 
subparagraph (C), a statement of the consumer’s right to 
request under subsection (d) that the agency furnish 
notifications under that subsection; and 


(C) provides written confirmation of the deletion and a copy of a 
consumer report on the consumer that is based on the 
consumer’s file after the deletion, not later than 5 business days 
after making the deletion. 


Statement of dispute. If the reinvestigation does not resolve the dispute, 
the consumer may file a brief statement setting forth the nature of the 
dispute. The consumer reporting agency may limit such statements to not 
more than one hundred words if it provides the consumer with assistance 
in writing a clear summary of the dispute. 


Notification of consumer dispute in subsequent consumer reports. When- 
ever a Statement of a dispute is filed, unless there is reasonable grounds 

to believe that it is frivolous or irrelevant, the consumer reporting agency 
shall, in any subsequent report containing the information in question, 
clearly note that it is disputed by the consumer and provide either the con- 
sumer’s statement or a clear and accurate codification or summary thereof. 


Notification of deletion of disputed information. Following any deletion of 
information which is found to be inaccurate or whose accuracy can no 
longer be verified or any notation as to disputed information, the 
consumer reporting agency shall, at the request of the consumer, furnish 
notification that the item has been deleted or the statement, codification 

or summary pursuant to subsection (b) or (c) of this section to any person 
specifically designated by the consumer who has within two years prior 
thereto received a consumer report for employment purposes, or within 
six months prior thereto received a consumer report for any other 
purpose, which contained the deleted or disputed information. 


Treatment of Complaints and Report to Congress 
(1) Jn general. The Bureau shall - 


(A) compile all complaints that it receives that a file of a consumer 
that is maintained by a consumer reporting agency described in 
section 603(p) contains incomplete or inaccurate information, 
with respect to which, the consumer appears to have disputed the 
completeness or accuracy with the consumer reporting agency or 
otherwise utilized the procedures provided by subsection (a); and 
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(f) 


(B) transmit each such complaint to each consumer reporting 
agency involved. 


(2) Exclusion. Complaints received or obtained by the Bureau pursuant 


to its investigative authority under the Consumer Financial Protection 
Act of 2010 shall not be subject to paragraph (1). 


(3) Agency responsibilities. Each consumer reporting agency described 


in section 603(p) that receives a complaint transmitted by the Bureau 
pursuant to paragraph (1) shall - 


(A) review each such complaint to determine whether all legal 
obligations imposed on the consumer reporting agency under 
this title (including any obligation imposed by an applicable 
court or administrative order) have been met with respect to the 
subject matter of the complaint; 


(B) provide reports on a regular basis to the Bureau regarding the 
determinations of and actions taken by the consumer reporting 
agency, if any, in connection with its review of such 
complaints; and 


(C) maintain, for a reasonable time period, records regarding the 
disposition of each such complaint that is sufficient to 
demonstrate compliance with this subsection. 


(4) Rulemaking authority. The Bureau may prescribe regulations, as 


appropriate to implement this subsection. 


(5) Annual report. The Bureau shall submit to the Committee on Banking, 


Housing, and Urban Affairs of the Senate and the Committee on 
Financial Services of the House of Representatives an annual report 
regarding information gathered by the Bureau under this subsection. 


Reinvestigation Requirement Applicable to Resellers 


(1) Exemption from general reinvestigation requirement. Except as 


provided in paragraph (2), a reseller shall be exempt from the 
requirements of this section. 


(2) Action required upon receiving notice of a dispute. If a reseller 


receives a notice from a consumer of a dispute concerning the 
completeness or accuracy of any item of information contained in 

a consumer report on such consumer produced by the reseller, the 
reseller shall, within 5 business days of receiving the notice, and free 
of charge - 


(A) determine whether the item of information is incomplete or 
inaccurate as a result of an act or omission of the reseller; and 
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(B) (i) _ if the reseller determines that the item of information is 
incomplete or inaccurate as a result of an act or omission 
of the reseller, not later than 20 days after receiving the 
notice, correct the information in the consumer report or 
delete it; or 


(ii) if the reseller determines that the item of information 
is not incomplete or inaccurate as a result of an act or 
omission of the reseller, convey the notice of the dispute, 
together with all relevant information provided by the 
consumer, to each consumer reporting agency that 
provided the reseller with the information that is the 
subject of the dispute, using an address or a notification 
mechanism specified by the consumer reporting agency 
for such notices. 


(3) Responsibility of consumer reporting agency to notify consumer 


through reseller. Upon the completion of a reinvestigation under this 
section of a dispute concerning the completeness or accuracy of any 
information in the file of a consumer by a consumer reporting agency 
that received notice of the dispute from a reseller under paragraph (2) - 


(A) _ the notice by the consumer reporting agency under paragraph 
(6), (7), or (8) of subsection (a) shall be provided to the reseller 
in lieu of the consumer; and 


(B) _ the reseller shall immediately reconvey such notice to the 
consumer, including any notice of a deletion by telephone in the 
manner required under paragraph (8)(A). 


(4) Reseller reinvestigations. No provision of this subsection shall be 


construed as prohibiting a reseller from conducting a reinvestigation 
of a consumer dispute directly. 


(g) Dispute Process for Veteran’s Medical Debt 


(1) 


(2) 


In general. With respect to a veteran’s medical debt, the veteran may 
submit a notice described in paragraph (2), proof of liability of the 
Department of Veterans Affairs for payment of that debt, or 
documentation that the Department of Veterans Affairs is in the 
process of making payment for authorized hospital care, medical 
services, or extended care services rendered to a consumer reporting 
agency or a reseller to dispute the inclusion of that debt on a 
consumer report of the veteran. 


Notification to veteran. The Department of Veterans Affairs shall 
submit to a veteran a notice that the Department of Veterans Affairs 
has assumed liability for part or all of a veteran’s medical debt. 
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(3) Deletion of information from file. If a consumer reporting agency 
receives notice, proof of liability, or documentation under paragraph 
(1), the consumer reporting agency shall delete all information 
relating to the veteran’s medical debt from the file of the veteran and 
notify the furnisher and the veteran of that deletion. 


§ 612. Charges for certain disclosures [15 U.S.C. § 1681)] 
See also 12 CFR Part 1022, Subpart N 
(a) Free Annual Disclosure 
(1) Nationwide Consumer Reporting Agencies 


(A) Jn general. All consumer reporting agencies described in 
subsections (p) and (w) of section 603 shall make all disclosures 
pursuant to section 609 once during any 12-month period upon 
request of the consumer and without charge to the consumer. 


(B) Centralized source. Subparagraph (A) shall apply with respect 
to a consumer reporting agency described in section 603(p) 
only if the request from the consumer is made using the 
centralized source established for such purpose in accordance 
with section 211(c) of the Fair and Accurate Credit 
Transactions Act of 2003. 

(C) Nationwide Specialty Consumer Reporting Agency 
(i) Jn general. The Bureau shall prescribe regulations 

applicable to each consumer reporting agency described 

in section 603(w) to require the establishment of a 
streamlined process for consumers to request consumer 
reports under subparagraph (A), which shall include, at a 
minimum, the establishment by each such agency of a toll- 
free telephone number for such requests. 


(ii) Considerations. In prescribing regulations under clause 
(i), the Bureau shall consider - 


(1) the significant demands that may be placed on 
consumer reporting agencies in providing such 
consumer reports; 


(II) appropriate means to ensure that consumer reporting 
agencies can satisfactorily meet those demands, 
including the efficacy of a system of staggering the 
availability to consumers of such consumer reports; and 


(III) the ease by which consumers should be able to 
contact consumer reporting agencies with respect to 
access to such consumer reports. 
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(iii)’ Date of issuance. The Bureau shall issue the regulations 
required by this subparagraph in final form not later than 6 
months after the date of enactment of the Fair and Accurate 
Credit Transactions Act of 2003. 


(iv)’ Consideration of ability to comply. The regulations of the 
Bureau under this subparagraph shall establish an effective 
date by which each nationwide specialty consumer report- 
ing agency (as defined in section 603(w)) shall be required 
to comply with subsection (a), which effective date — 


(1) shall be established after consideration of the ability 
of each nationwide specialty consumer reporting 
agency to comply with subsection (a); and 


(I) shall be not later than 6 months after the date on 
which such regulations are issued in final form (or 
such additional period not to exceed 3 months, as the 
Bureau determines appropriate). 


(2) Timing. A consumer reporting agency shall provide a consumer 
report under paragraph (1) not later than 15 days after the date on 
which the request is received under paragraph (1). 


(3) Reinvestigations. Notwithstanding the time periods specified in 
section 611(a)(1), a reinvestigation under that section by a consumer 
reporting agency upon a request of a consumer that is made after 
receiving a consumer report under this subsection shall be completed 
not later than 45 days after the date on which the request is received. 


(4) Exception for first 12 months of operation. This subsection shall 
not apply to a consumer reporting agency that has not been 
furnishing consumer reports to third parties on a continuing basis 
during the 12-month period preceding a request under paragraph (1), 
with respect to consumers residing nationwide. 


(b) Free disclosure after adverse notice to consumer. Each consumer 
reporting agency that maintains a file on a consumer shall make all 
disclosures pursuant to section 609 [§ 1681g] without charge to the 
consumer if, not later than 60 days after receipt by such consumer of a 
notification pursuant to section 615 [§ 1681m], or of a notification from a 
debt collection agency affiliated with that consumer reporting agency 


7 Subsections 612(a)(1)(C)(ii) and (iv) are obsolete. They relate to the to the issuance and effective dates of 
the “free report” rules that the 2003 FACT Act required the Commission to publish. The rules were pub- 
lished on time in June 2004 and updated in March 2010. The subsections appear as written, including 2010 
amendments to the FCRA that changed “Commission” to “Bureau” (effective July 21, 2011) in several 
places in the FCRA. 
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(c) 


(d) 


(e) 


(f) 


stating that the consumer’s credit rating may be or has been adversely 
affected, the consumer makes a request under section 609 [§ 1681g]. 


Free disclosure under certain other circumstances. Upon the request of 
the consumer, a consumer reporting agency shall make all disclosures 
pursuant to section 609 [§ 1681g] once during any 12-month period 
without charge to that consumer if the consumer certifies in writing that 
the consumer 


(1) is unemployed and intends to apply for employment in the 60-day 
period beginning on the date on which the certification is made; 


(2) is a recipient of public welfare assistance; or 


(3) has reason to believe that the file on the consumer at the agency 
contains inaccurate information due to fraud. 


Free disclosures in connection with fraud alerts. Upon the request of a 
consumer, a consumer reporting agency described in section 603(p) shall 
make all disclosures pursuant to section 609 without charge to the 
consumer, as provided in subsections (a)(2) and (b)(2) of section 605A, 
as applicable. 


Other charges prohibited. A consumer reporting agency shall not impose 
any charge on a consumer for providing any notification required by this 
title or making any disclosure required by this title, except as authorized 
by subsection (f). 


Reasonable Charges Allowed for Certain Disclosures 


(1) Jn general. In the case of a request from a consumer other than 
a request that is covered by any of subsections (a) through (d), 
a consumer reporting agency may impose a reasonable charge on 
a consumer 


(A) for making a disclosure to the consumer pursuant to section 609 
[§ 1681g], which charge 


(i) shall not exceed $8; and 


(ii) shall be indicated to the consumer before making the 
disclosure; and 


(B) for furnishing, pursuant to 611(d) [§ 1681i], following a 
reinvestigation under section 611(a) [§ 1681i], a statement, 
codification, or summary to a person designated by the 
consumer under that section after the 30-day period beginning 
on the date of notification of the consumer under paragraph (6) 


8 Pursuant to Section 612(f)(2), the Federal Trade Commission set the maximum charge at $11.00, effective 
January 1, 2011. See 75 Fed. Reg. 80817 (Dec. 23, 2010). The Bureau will set the charge for 2012 and 
later years. 
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or (8) of section 611(a) [§ 16811] with respect to the 
reinvestigation, which charge 


(i) _ shall not exceed the charge that the agency would impose 
on each designated recipient for a consumer report; and 


(ii) shall be indicated to the consumer before furnishing such 
information. 


(2) Modification of amount. The Bureau shall increase the amount 


referred to in paragraph (1)(A)(i) on January 1 of each year, based 
proportionally on changes in the Consumer Price Index, with 
fractional changes rounded to the nearest fifty cents.® 


(g) Prevention of Deceptive Marketing of Credit Reports 


(1) 


(2) 


§ 613. 


In general. Subject to rulemaking pursuant to section 205(b) of 

the Credit CARD Act of 2009, any advertisement for a free credit 
report in any medium shall prominently disclose in such advertise- 
ment that free credit reports are available under Federal law at 
AnnualCreditReport.com (or such other source as may be authorized 
under Federal law). 


Television and radio advertisement. In the case of an advertisement 
broadcast by television, the disclosures required under paragraph 
(1) shall be included in the audio and visual part of such 
advertisement. In the case of an advertisement broadcast by 
television or radio, the disclosure required under paragraph (1) 
shall consist only of the following: “This is not the free credit 
report provided for by Federal law.” 


Public record information for employment purposes 
[15 U.S.C. § 1681k] 


(a) In general. A consumer reporting agency which furnishes a consumer 
report for employment purposes and which for that purpose compiles and 
reports items of information on consumers which are matters of public 
record and are likely to have an adverse effect upon a consumer’s ability 
to obtain employment shall 


(1) 


(2) 


at the time such public record information is reported to the user of 
such consumer report, notify the consumer of the fact that public 
record information is being reported by the consumer reporting 
agency, together with the name and address of the person to whom 
such information is being reported; or 


maintain strict procedures designed to insure that whenever public 
record information which is likely to have an adverse effect on a 
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consumer’s ability to obtain employment is reported it is complete 
and up to date. For purposes of this paragraph, items of public record 
relating to arrests, indictments, convictions, suits, tax liens, and 
outstanding judgments shall be considered up to date if the current 
public record status of the item at the time of the report is reported. 


(b) Exemption for national security investigations. Subsection (a) does not 
apply in the case of an agency or department of the United States 
Government that seeks to obtain and use a consumer report for 
employment purposes, if the head of the agency or department makes 
a written finding as prescribed under section 604(b)(4)(A). 


§614. Restrictions on investigative consumer reports 
[15 U.S.C. § 16811] 


Whenever a consumer reporting agency prepares an investigative consumer 
report, no adverse information in the consumer report (other than information 
which is a matter of public record) may be included in a subsequent consumer 
report unless such adverse information has been verified in the process of making 
such subsequent consumer report, or the adverse information was received within 
the three-month period preceding the date the subsequent report is furnished. 


§ 615. Requirements on users of consumer reports 
[15 U.S.C. § 1681m] 


(a) Duties of users taking adverse actions on the basis of information 
contained in consumer reports. If any person takes any adverse action 
with respect to any consumer that is based in whole or in part on any 
information contained in a consumer report, the person shall 


(1) provide oral, written, or electronic notice of the adverse action to the 
consumer; 


(2) provide to the consumer written or electronic disclosure 


(A) of a numerical credit score as defined in section 609(f)(2) 
(A) used by such person in taking any adverse action based in 
whole or in part on any information in a consumer report; and 


(B) of the information set forth in subparagraphs (B) through (E) of 
section 609(f)(1); 


(3) provide to the consumer orally, in writing, or electronically 


(A) the name, address, and telephone number of the consumer 
reporting agency (including a toll-free telephone number 
established by the agency if the agency compiles and maintains 
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files on consumers on a nationwide basis) that furnished the 
report to the person; and 


(B) a statement that the consumer reporting agency did not make 
the decision to take the adverse action and is unable to provide 
the consumer the specific reasons why the adverse action was 
taken; and 


provide to the consumer an oral, written, or electronic notice of the 
consumer’s right 


(A) to obtain, under section 612 [§ 1681j], a free copy of a 
consumer report on the consumer from the consumer reporting 
agency referred to in paragraph (3), which notice shall include 
an indication of the 60-day period under that section for 
obtaining such a copy; and 


(B) to dispute, under section 611 [§ 1681i], with a consumer 
reporting agency the accuracy or completeness of any 
information in a consumer report furnished by the agency. 


(b) Adverse Action Based on Information Obtained from Third Parties Other 
than Consumer Reporting Agencies 


(1) 


(2) 


In general. Whenever credit for personal, family, or household 
purposes involving a consumer is denied or the charge for such credit 
is increased either wholly or partly because of information obtained 
from a person other than a consumer reporting agency bearing upon 
the consumer’s credit worthiness, credit standing, credit capacity, 
character, general reputation, personal characteristics, or mode of 
living, the user of such information shall, within a reasonable period 
of time, upon the consumer’s written request for the reasons for such 
adverse action received within sixty days after learning of such 
adverse action, disclose the nature of the information to the consumer. 
The user of such information shall clearly and accurately disclose to 
the consumer his right to make such written request at the time such 
adverse action is communicated to the consumer. 


Duties of Person Taking Certain Actions Based on Information 
Provided by Affiliate 


(A) Duties, generally. If a person takes an action described in 
subparagraph (B) with respect to a consumer, based in whole 
or in part on information described in subparagraph (c), the 
person shall 
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(B) 


(C) 


(i) notify the consumer of the action, including a statement 
that the consumer may obtain the information in 
accordance with clause (ii); and 


(ii) upon a written request from the consumer received within 
60 days after transmittal of the notice required by clause 
(i), disclose to the consumer the nature of the information 
upon which the action is based by not later than 30 days 
after receipt of the request. 


Action described. An action referred to in subparagraph (A) is 
an adverse action described in section 603(k)(1)(A) [§ 1681a], 
taken in connection with a transaction initiated by the 
consumer, or any adverse action described in clause (i) or (ii) 
of section 603(k)(1)(B) [§ 1681a]. 


Information described. Information referred to in 
subparagraph (A) 
(i) except as provided in clause (ii), is information that 
(1) is furnished to the person taking the action by a 
person related by common ownership or affiliated by 


common corporate control to the person taking the 
action; and 


(II) bears on the credit worthiness, credit standing, credit 
capacity, character, general reputation, personal 
characteristics, or mode of living of the consumer; and 


(ii) does not include 


(I) information solely as to transactions or experiences 
between the consumer and the person furnishing the 
information; or 


(I) information in a consumer report. 


(c) Reasonable procedures to assure compliance. No person shall be held 


(d) 


liable for any violation of this section if he shows by a preponderance of 
the evidence that at the time of the alleged violation he maintained reason- 
able procedures to assure compliance with the provisions of this section. 


Duties of Users Making Written Credit or Insurance Solicitations on the 
Basis of Information Contained in Consumer Files 


(1) In general. Any person who uses a consumer report on any 
consumer in connection with any credit or insurance transaction that 
is not initiated by the consumer, that is provided to that person under 
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section 604(c)(1)(B) [§ 1681b], shall provide with each written 
solicitation made to the consumer regarding the transaction a clear 
and conspicuous statement that 


(A) 


(B) 


(C) 


(D) 


(E) 


information contained in the consumer’s consumer report was 
used in connection with the transaction; 


the consumer received the offer of credit or insurance because 
the consumer satisfied the criteria for credit worthiness or 
insurability under which the consumer was selected for the offer; 


if applicable, the credit or insurance may not be extended if, 
after the consumer responds to the offer, the consumer does not 
meet the criteria used to select the consumer for the offer or 
any applicable criteria bearing on credit worthiness or 
insurability or does not furnish any required collateral; 


the consumer has a right to prohibit information contained in 
the consumer’s file with any consumer reporting agency from 
being used in connection with any credit or insurance 
transaction that is not initiated by the consumer; and 


the consumer may exercise the right referred to in subparagraph 
(D) by notifying a notification system established under section 
604(e) [§ 1681b]. 


(2) Disclosure of address and telephone number, format. A statement 
under paragraph (1) shall - 


(A) 


(B) 


include the address and toll-free telephone number of the 
appropriate notification system established under section 
604(e); and 


be presented in such format and in such type size and manner 
as to be simple and easy to understand, as established by the 
Bureau, by rule, in consultation with the Federal Trade 
Commission, Federal banking agencies and the National Credit 
Union Administration. 


See also 12 CFR Part 1022.54, 12 CFR Part 1022, App D, 16 CFR Part 642, 


16 CFR Part 698, App C, 70 Fed. Reg. 5022 (01/31/05), 
86 Fed. Reg. 50848-54 (09/13/21) 


(3) Maintaining criteria on file. A person who makes an offer of credit 
or insurance to a consumer under a credit or insurance transaction 
described in paragraph (1) shall maintain on file the criteria used to 
select the consumer to receive the offer, all criteria bearing on credit 
worthiness or insurability, as applicable, that are the basis for 
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(e) 


(4) 


determining whether or not to extend credit or insurance pursuant to 
the offer, and any requirement for the furnishing of collateral as a 
condition of the extension of credit or insurance, until the expiration 
of the 3-year period beginning on the date on which the offer is made 
to the consumer. 


Authority of federal agencies regarding unfair or deceptive acts or 
practices not affected. This section is not intended to affect the 
authority of any Federal or State agency to enforce a prohibition 
against unfair or deceptive acts or practices, including the making 
of false or misleading statements in connection with a credit or 
insurance transaction that is not initiated by the consumer. 


See also 16 CFR Part 681, 72 Fed. Reg. 63772-74 (11/09/07), 
74 Fed. Reg. 22640-41 (05/14/09), 77 Fed. Reg. 72712-15 (12/06/12) 


Red Flag Guidelines and Regulations Required (1)Guidelines. The Federal 
banking agencies, the National Credit Union Administration, the Federal 
Trade Commission, the Commodity Futures Trading Commission, and 
the Securities and Exchange Commission shall jointly, with respect to the 
entities that are subject to their respective enforcement authority under 
section 621 - 


(A) establish and maintain guidelines for use by each financial 
institution and each creditor regarding identity theft with 
respect to account holders at, or customers of, such entities, 
and update such guidelines as often as necessary; 


(B) prescribe regulations requiring each financial institution and 
each creditor to establish reasonable policies and procedures for 
implementing the guidelines established pursuant to 
subparagraph (A), to identify possible risks to account holders 
or customers or to the safety and soundness of the institution or 
customers; and 


(C) prescribe regulations applicable to card issuers to ensure that, if 
a card issuer receives notification of a change of address for an 
existing account, and within a short period of time (during 
at least the first 30 days after such notification is received) 
receives a request for an additional or replacement card for the 
same account, the card issuer may not issue the additional or 
replacement card, unless the card issuer, in accordance with 
reasonable policies and procedures - 
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(i) notifies the cardholder of the request at the former address 
of the cardholder and provides to the cardholder a means 
of promptly reporting incorrect address changes; 


(ii) notifies the cardholder of the request by such other means 
of communication as the cardholder and the card issuer 
previously agreed to; or 


(iii) uses other means of assessing the validity of the change 
of address, in accordance with reasonable policies and 
procedures established by the card issuer in accordance 
with the regulations prescribed under subparagraph (B). 


(2) Criteria 
(A) Jn general. In developing the guidelines required by paragraph 


(B) 


(1)(A), the agencies described in paragraph (1) shall identify 
patterns, practices, and specific forms of activity that indicate 
the possible existence of identity theft. 


Inactive accounts. In developing the guidelines required by 
paragraph (1)(A), the agencies described in paragraph (1) shall 
consider including reasonable guidelines providing that when 
a transaction occurs with respect to a credit or deposit account 
that has been inactive for more than 2 years, the creditor or 
financial institution shall follow reasonable policies and 
procedures that provide for notice to be given to a consumer 
in a manner reasonably designed to reduce the likelihood of 
identity theft with respect to such account. 


(3) Consistency with verification requirements. Guidelines established 
pursuant to paragraph (1) shall not be inconsistent with the policies 
and procedures required under section 5318(1) of title 31, United 
States Code. 


(4) Definitions. As used in this subsection, the term “creditor” - 


(A) means a creditor, as defined in section 702 of the Equal Credit 


Opportunity Act (15 U.S.C. 1691a), that regularly and in the 
ordinary course of business 


(i) obtains or uses consumer reports, directly or indirectly, in 
connection with a credit transaction; 


(ii) furnishes information to consumer reporting agencies, as 
described in section 623, in connection with a credit 
transaction; or 
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(B) 


(C) 


(iii) advances funds to or on behalf of a person, based on an 
obligation of the person to repay the funds or repayable from 
specific property pledged by or on behalf of the person; 


does not include a creditor described in subparagraph (A)(i11) 
that advances funds on behalf of a person for expenses incidental 
to a service provided by the creditor to that person; and 


includes any other type of creditor, as defined in that section 
702, as the agency described in paragraph (1) having authority 
over that creditor may determine appropriate by rule 
promulgated by that agency, based on a determination that 
such creditor offers or maintains accounts that are subject to a 
reasonably foreseeable risk of identity theft. 


(f) Prohibition on Sale or Transfer of Debt Caused by Identity Theft 


(1) Jn general. No person shall sell, transfer for consideration, or place 
for collection a debt that such person has been notified under section 
605B has resulted from identity theft. 


(2) Applicability. The prohibitions of this subsection shall apply to all 
persons collecting a debt described in paragraph (1) after the date of 
a notification under paragraph (1). 


(g) 


(3) Rule of construction. Nothing in this subsection shall be construed 
to prohibit - 


(A) 


(B) 


(C) 


the repurchase of a debt in any case in which the assignee of 
the debt requires such repurchase because the debt has resulted 
from identity theft; 


the securitization of a debt or the pledging of a portfolio of debt 
as collateral in connection with a borrowing; or 


the transfer of debt as a result of a merger, acquisition, 
purchase and assumption transaction, or transfer of substantially 
all of the assets of an entity. 


Debt collector communications concerning identity theft. If a person acting 
as a debt collector (as that term is defined in title VII) on behalf of a third 
party that is a creditor or other user of a consumer report is notified that 
any information relating to a debt that the person is attempting to collect 
may be fraudulent or may be the result of identity theft, that person shall - 


(1) 


(2) 


notify the third party that the information may be fraudulent or may 
be the result of identity theft; and 


upon request of the consumer to whom the debt purportedly relates, 
provide to the consumer all information to which the consumer would 
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otherwise be entitled if the consumer were not a victim of identity 
theft, but wished to dispute the debt under provisions of law 
applicable to that person. 


(h) Duties of Users in Certain Credit Transactions 


(1) 


(2) 


(3) 


(4) 


(5) 


In general. Subject to rules prescribed as provided in paragraph (6), 
if any person uses a consumer report in connection with an 
application for, or a grant, extension, or other provision of, credit 

on material terms that are materially less favorable than the most 
favorable terms available to a substantial proportion of consumers 
from or through that person, based in whole or in part on a consumer 
report, the person shall provide an oral, written, or electronic notice 
to the consumer in the form and manner required by regulations 
prescribed in accordance with this subsection. 


Timing. The notice required under paragraph (1) may be provided 

at the time of an application for, or a grant, extension, or other 
provision of, credit or the time of communication of an approval of 
an application for, or grant, extension, or other provision of, credit, 
except as provided in the regulations prescribed under paragraph (6). 


Exceptions. No notice shall be required from a person under this 
subsection if - 


(A) the consumer applied for specific material terms and was 
granted those terms, unless those terms were initially specified 
by the person after the transaction was initiated by the 
consumer and after the person obtained a consumer report; or 


(B) the person has provided or will provide a notice to the consumer 
under subsection (a) in connection with the transaction. 


Other notice not sufficient. A person that is required to provide a 
notice under subsection (a) cannot meet that requirement by 
providing a notice under this subsection. 


Content and delivery of notice. A notice under this subsection shall, 
at a minimum - 


(A) include a statement informing the consumer that the terms 
offered to the consumer are set based on information from a 
consumer report; 


(B) identify the consumer reporting agency furnishing the report; 


(C) include a statement informing the consumer that the consumer 
may obtain a copy of a consumer report from that consumer 
reporting agency without charge; 
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(D) include the contact information specified by that consumer 
reporting agency for obtaining such consumer reports 
(including a toll-free telephone number established by the 
agency in the case of a consumer reporting agency described in 
section 603(p)); and 


(E) include a statement informing the consumer of - 


(i) anumerical credit score as defined in section 609(f)(2) 
(A), used by such person in making the credit decision 
described in paragraph (1) based in whole or in part on 
any information in a consumer report; and 


(ii) the information set forth in subparagraphs (B) through (E) 
of section 609(f)(1). 


See also 12 CFR Part 1022, Subpart H, 16 CFR Part 640, 
75 Fed. Reg. 2724 (01/15/10), 86 Fed. Reg. 51795-51817 (09/17/21) 


(6) Rulemaking 


(A) Rules required. The Bureau shall prescribe rules to carry out 
this subsection. 


(B) Content. Rules required by subparagraph (A) shall address, but 
are not limited to - 


(i) the form, content, time, and manner of delivery of any 
notice under this subsection; 


(ii) clarification of the meaning of terms used in this 
subsection, including what credit terms are material, and 
when credit terms are materially less favorable; 


(iii) exceptions to the notice requirement under this subsection 
for classes of persons or transactions regarding which 
the agencies determine that notice would not significantly 
benefit consumers; 


(iv) a model notice that may be used to comply with this 
subsection; and 


(v) the timing of the notice required under paragraph (1), 
including the circumstances under which the notice must 
be provided after the terms offered to the consumer were 
set based on information from a consumer report. 


(7) Compliance. A person shall not be liable for failure to perform the duties 
required by this section if, at the time of the failure, the person maintained 
reasonable policies and procedures to comply with this section. 


(8) Enforcement 
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(A) No civil actions. Sections 616 and 617 shall not apply to any 
failure by any person to comply with this section. 


(B) Administrative enforcement. This section shall be enforced 
exclusively under section 621 by the Federal agencies and 
officials identified in that section. 


§ 616. Civil liability for willful noncompliance [15 U.S.C. § 1681n] 


(a) 


(b) 


(c) 


(d) 


In general. Any person who willfully fails to comply with any requirement 
imposed under this title with respect to any consumer is liable to that 
consumer in an amount equal to the sum of 


(1) (A) any actual damages sustained by the consumer as a result of 
the failure or damages of not less than $100 and not more than 
$1,000; or 


(B) in the case of liability of a natural person for obtaining a 
consumer report under false pretenses or knowingly without a 
permissible purpose, actual damages sustained by the consumer 
as a result of the failure or $1,000, whichever is greater; 


(2) such amount of punitive damages as the court may allow; and 


(3) in the case of any successful action to enforce any liability under this 
section, the costs of the action together with reasonable attorney’s 
fees as determined by the court. 


Civil liability for knowing noncompliance. Any person who obtains a 
consumer report from a consumer reporting agency under false pretenses 
or knowingly without a permissible purpose shall be liable to the consumer 
reporting agency for actual damages sustained by the consumer reporting 
agency or $1,000, whichever is greater. 


Attorney ’s fees. Upon a finding by the court that an unsuccessful pleading, 
motion, or other paper filed in connection with an action under this 
section was filed in bad faith or for purposes of harassment, the court 
shall award to the prevailing party attorney’s fees reasonable in relation to 
the work expended in responding to the pleading, motion, or other paper. 


Clarification of willful noncompliance. For the purposes of this section, 
any person who printed an expiration date on any receipt provided to a 
consumer cardholder at a point of sale or transaction between December 
4, 2004, and the date of the enactment of this subsection but otherwise 
complied with the requirements of section 605(g) for such receipt shall not 
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be in willful noncompliance with section 605(g) by reason of printing such 
expiration date on the receipt. 


§617. Civil liability for negligent noncompliance [15 U.S.C. § 16810] 


(a) Jn general. Any person who is negligent in failing to comply with any 
requirement imposed under this title with respect to any consumer is liable 
to that consumer in an amount equal to the sum of 


(1) any actual damages sustained by the consumer as a result of the 
failure; and 


(2) inthe case of any successful action to enforce any liability under this 
section, the costs of the action together with reasonable attorney’s 
fees as determined by the court. 


(b) Attorney’s fees. On a finding by the court that an unsuccessful pleading, 
motion, or other paper filed in connection with an action under this 
section was filed in bad faith or for purposes of harassment, the court 
shall award to the prevailing party attorney’s fees reasonable in relation to 
the work expended in responding to the pleading, motion, or other paper. 


§618. Jurisdiction of courts; limitation of actions [15 U.S.C. § 1681p] 


An action to enforce any liability created under this title may be brought in 
any appropriate United States district court, without regard to the amount in 
controversy, or in any other court of competent jurisdiction, not later than the 
earlier of (1) 2 years after the date of discovery by the plaintiff of the violation 
that is the basis for such liability; or (2) 5 years after the date on which the 
violation that is the basis for such liability occurs. 


§ 619. Obtaining information under false pretenses 
[15 U.S.C. § 1681q] 


Any person who knowingly and willfully obtains information on a consumer 
from a consumer reporting agency under false pretenses shall be fined under 
title 18, United States Code, imprisoned for not more than 2 years, or both. 


§ 620. Unauthorized disclosures by officers or employees 
[15 U.S.C. § 1681] 


Any officer or employee of a consumer reporting agency who knowingly and 
willfully provides information concerning an individual from the agency’s files 
to a person not authorized to receive that information shall be fined under title 
18, United States Code, imprisoned for not more than 2 years, or both. 
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Administrative enforcement [15 U.S.C. § 1681s] 


(a) Enforcement by Federal Trade Commission. 


(1) In General. The Federal Trade Commission shall be authorized to 


(2) 


enforce compliance with the requirements imposed by this title under 
the Federal Trade Commission Act (15 U.S.C. 41 et seq.), with 
respect to consumer reporting agencies and all other persons subject 
thereto, except to the extent that enforcement of the requirements 
imposed under this title is specifically committed to some other 
Government agency under any of subparagraphs (A) through (G) 

of subsection (b)(1), and subject to subtitle B of the Consumer 
Financial Protection Act of 2010, subsection (b). For the purpose of 
the exercise by the Federal Trade Commission of its functions and 
powers under the Federal Trade Commission Act, a violation of any 
requirement or prohibition imposed under this title shall constitute 

an unfair or deceptive act or practice in commerce, in violation of 
section 5(a) of the Federal Trade Commission Act (15 U.S.C. 45(a)), 
and shall be subject to enforcement by the Federal Trade Commission 
under section 5(b) of that Act with respect to any consumer reporting 
agency or person that is subject to enforcement by the Federal Trade 
Commission pursuant to this subsection, irrespective of whether that 
person is engaged in commerce or meets any other jurisdictional 
tests under the Federal Trade Commission Act. The Federal 

Trade Commission shall have such procedural, investigative, and 
enforcement powers, including the power to issue procedural rules in 
enforcing compliance with the requirements imposed under this title 
and to require the filing of reports, the production of documents, and 
the appearance of witnesses, as though the applicable terms and 
conditions of the Federal Trade Commission Act were part of this 
title. Any person violating any of the provisions of this title shall be 
subject to the penalties and entitled to the privileges and immunities 
provided in the Federal Trade Commission Act as though the 
applicable terms and provisions of such Act are part of this title. 


Penalties 


(A) Knowing Violations. Except as otherwise provided by subtitle B 
of the Consumer Financial Protection Act of 2010, in the event 
of a knowing violation, which constitutes a pattern or practice 
of violations of this title, the Federal Trade Commission may 
commence a civil action to recover a civil penalty in a district 
court of the United States against any person that violates this 
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title. In such action, such person shall be liable for a civil pen- 
alty of not more than $2,500 per violation.’ 


(B) Determining Penalty Amount. In determining the amount of a 
civil penalty under subparagraph (A), the court shall take into 
account the degree of culpability, any history of such prior 
conduct, ability to pay, effect on ability to continue to do 
business, and such other matters as justice may require. 


(C) Limitation. Notwithstanding paragraph (2), a court may not 
impose any civil penalty on a person for a violation of section 
623(a)(1), unless the person has been enjoined from committing 
the violation, or ordered not to commit the violation, in an action 
or proceeding brought by or on behalf of the Federal Trade 
Commission, and has violated the injunction or order, and the 
court may not impose any civil penalty for any violation occurring 
before the date of the violation of the injunction or order. 


(b) Enforcement by Other Agencies. 


(1) In General. Subject to subtitle B of the Consumer Financial 
Protection Act of 2010, compliance with the requirements imposed 
under this title with respect to consumer reporting agencies, persons 
who use consumer reports from such agencies, persons who furnish 
information to such agencies, and users of information that are 
subject to section 615(d) shall be enforced under - 


(A) _ section 8 of the Federal Deposit Insurance Act (12 U.S.C. 
1818), by the appropriate Federal banking agency, as defined 
in section 3(q) of the Federal Deposit Insurance Act (12 U.S.C. 
1813(q)), with respect to - 


(i) any national bank or State savings association, and any 
Federal branch or Federal agency of a foreign bank; 


(ii) any member bank of the Federal Reserve System (other 
than a national bank), a branch or agency of a foreign 
bank (other than a Federal branch, Federal agency, or 
insured State branch of a foreign bank), a commercial 
lending company owned or controlled by a foreign bank, 
and any organization operating under section 25 or 25A of 
the Federal Reserve Act; and 


9 Pursuant to the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, the Federal 
Trade Commission increased the maximum civil penalty to $4,367 per violation. See 87 Fed. Reg. 1070 
(Jan 10, 2022). 
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(iii) any bank or Federal savings association insured by the 
Federal Deposit Insurance Corporation (other than a 
member of the Federal Reserve System) and any insured 
State branch of a foreign bank; 


the Federal Credit Union Act (12 U.S.C. 1751 et seq.), by the 
Administrator of the National Credit Union Administration with 
respect to any Federal credit union; 


subtitle IV of title 49, United States Code, by the Secretary of 
Transportation, with respect to all carriers subject to the 
jurisdiction of the Surface Transportation Board; 


the Federal Aviation Act of 1958 (49 U.S.C. App. 1301 et 
seq.), by the Secretary of Transportation, with respect to any 
air carrier or foreign air carrier subject to that Act; 


the Packers and Stockyards Act, 1921 (7 U.S.C. 181 et seq.) 
(except as provided in section 406 of that Act), by the Secretary 
of Agriculture, with respect to any activities subject to that Act; 


the Commodity Exchange Act, with respect to a person subject to 
the jurisdiction of the Commodity Futures Trading Commission; 


the Federal securities laws, and any other laws that are subject 
to the jurisdiction of the Securities and Exchange Commission, 
with respect to a person that is subject to the jurisdiction of the 
Securities and Exchange Commission; and 


subtitle E of the Consumer Financial Protection Act of 2010, 
by the Bureau, with respect to any person subject to this title. 


(2) Incorporated Definitions. The terms used in paragraph (1) that are 
not defined in this title or otherwise defined in section 3(s) of the 
Federal Deposit Insurance Act (12 U.S.C. 1813(s)) have the same 
meanings as in section 1(b) of the International Banking Act of 1978 
(12 U.S.C. 3101). 


(c) State Action for Violations 


(1) Authority of states. In addition to such other remedies as are 
provided under State law, if the chief law enforcement officer of a 
State, or an official or agency designated by a State, has reason to 
believe that any person has violated or is violating this title, the State - 


(A) 


may bring an action to enjoin such violation in any appropriate 
United States district court or in any other court of competent 
jurisdiction; 
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(B) subject to paragraph (5), may bring an action on behalf of the 
residents of the State to recover 


(i) damages for which the person is liable to such residents un- 
der sections 616 and 617 [§§ 1681n and 1681o] as a result 
of the violation; 


(ii) in the case of a violation described in any of paragraphs 
(1) through (3) of section 623(c) [§ 1681s-2], damages for 
which the person would, but for section 623(c), be liable to 
such residents as a result of the violation; or 


(iii) damages of not more than $1,000 for each willful or 
negligent violation; and 


(C) inthe case of any successful action under subparagraph (A) or 
(B), shall be awarded the costs of the action and reasonable 
attorney fees as determined by the court. 


(2) Rights of federal regulators. The State shall serve prior written notice 
of any action under paragraph (1) upon the Bureau and the Federal 
Trade Commission or the appropriate Federal regulator determined 
under subsection (b) and provide the Bureau and the Federal Trade 
Commission or appropriate Federal regulator with a copy of its 
complaint, except in any case in which such prior notice is not 
feasible, in which case the State shall serve such notice immediately 
upon instituting such action. The Bureau and the Federal Trade 
Commission or appropriate Federal regulator shall have the right - 


(A) _ to intervene in the action; 
(B) upon so intervening, to be heard on all matters arising therein; 


(C) to remove the action to the appropriate United States district 
court; and 


(D) to file petitions for appeal. 


(3) Investigatory powers. For purposes of bringing any action under 
this subsection, nothing in this subsection shall prevent the chief law 
enforcement officer, or an official or agency designated by a State, from 
exercising the powers conferred on the chief law enforcement officer 
or such official by the laws of such State to conduct investigations or to 
administer oaths or affirmations or to compel the attendance of witnesses 
or the production of documentary and other evidence. 


(4) Limitation on state action while federal action pending. If the Bureau, 
the Federal Trade Commission, or the appropriate Federal regulator 
has instituted a civil action or an administrative action 
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under section 8 of the Federal Deposit Insurance Act for a violation 
of this title, no State may, during the pendency of such action, bring 
an action under this section against any defendant named in the 
complaint of the Bureau, the Federal Trade Commission, or the 
appropriate Federal regulator for any violation of this title that is 
alleged in that complaint. 


(5) Limitations on State Actions for Certain Violations 


(A) Violation of injunction required. A State may not bring an 
action against a person under paragraph (1)(B) for a violation 
described in any of paragraphs (1) through (3) of section 
623(c), unless 


(1) | the person has been enjoined from committing the 
violation, in an action brought by the State under paragraph 
(1)(A); and 


(ii) the person has violated the injunction. 


(B) Limitation on damages recoverable. In an action against a 
person under paragraph (1)(B) for a violation described in any 
of paragraphs (1) through (3) of section 623(c), a State may not 
recover any damages incurred before the date of the violation 
of an injunction on which the action is based. 


(d) Enforcement under other authority. For the purpose of the exercise by 


(e) 


any agency referred to in subsection (b) of this section of its powers under 
any Act referred to in that subsection, a violation of any requirement 
imposed under this title shall be deemed to be a violation of a requirement 
imposed under that Act. In addition to its powers under any provision of 
law specifically referred to in subsection (b) of this section, each of the 
agencies referred to in that subsection may exercise, for the purpose of 
enforcing compliance with any requirement imposed under this title any 
other authority conferred on it by law. 


Regulatory Authority 


(1) In General. The Bureau shall prescribe such regulations as are 
necessary to carry out the purposes of this title, except with respect 
to sections 615(e) and 628. The Bureau may prescribe regulations 
as may be necessary or appropriate to administer and carry out 
the purposes and objectives of this title, and to prevent evasions 
thereof or to facilitate compliance therewith. Except as provided 
in section 1029(a) of the Consumer Financial Protection Act of 
2010, the regulations prescribed by the Bureau under this title shall 
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apply to any person that is subject to this title, notwithstanding the 
enforcement authorities granted to other agencies under this section. 


(2) Deference. Notwithstanding any power granted to any Federal agency 


under this title, the deference that a court affords to a Federal agency 
with respect to a determination made by such agency relating to the 
meaning or interpretation of any provision of this title that is subject 
to the jurisdiction of such agency shall be applied as if that agency 
were the only agency authorized to apply, enforce, interpret, or 
administer the provisions of this title The regulations prescribed by 
the Bureau under this title shall apply to any person that is subject to 
this title, notwithstanding the enforcement authorities granted to other 
agencies under this section. 


(f) Coordination of Consumer Complaint Investigations 


(g) 


(1) Jn general. Each consumer reporting agency described in section 


603(p) shall develop and maintain procedures for the referral to each 
other such agency of any consumer complaint received by the agency 
alleging identity theft, or requesting a fraud alert under section 605A 
or a block under section 605B. 


(2) Model form and procedure for reporting identity theft. The Bureau, 


in consultation with the Federal Trade Commission, the Federal 
banking agencies, and the National Credit Union Administration, 
shall develop a model form and model procedures to be used by 
consumers who are victims of identity theft for contacting and 
informing creditors and consumer reporting agencies of the fraud. 


See also 70 Fed. Reg. 21792 (04/27/05) 


(3) Annual summary reports. Each consumer reporting agency described 


in section 603(p) shall submit an annual summary report to the 
Bureau on consumer complaints received by the agency on identity 
theft or fraud alerts. 


Bureau regulation of coding of trade names. If the Bureau determines 
that a person described in paragraph (9) of section 623(a) has not met the 
requirements of such paragraph, the Bureau shall take action to ensure the 
person’s compliance with such paragraph, which may include issuing 
model guidance or prescribing reasonable policies and procedures, as 
necessary to ensure that such person complies with such paragraph. 
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§ 622. Information on overdue child support obligations 
[15 U.S.C. § 1681s-1] 


Notwithstanding any other provision of this title, a consumer reporting agency 
shall include in any consumer report furnished by the agency in accordance 
with section 604 [§ 1681b] of this title, any information on the failure of the 
consumer to pay overdue support which 


(1) is provided 


(A) 


(B) 


to the consumer reporting agency by a State or local child 
support enforcement agency; or 


to the consumer reporting agency and verified by any local, 
State, or Federal government agency; and 


(2) antedates the report by 7 years or less. 


§ 623. Responsibilities of furnishers of information to consumer 
reporting agencies [15 U.S.C. § 1681s-2] 


(a) Duty of Furnishers of Information to Provide Accurate Information 
(1) Prohibition 


(A) 


(B) 


(C) 


(D) 


Reporting information with actual knowledge of errors. A 
person shall not furnish any information relating to a consumer 
to any consumer reporting agency if the person knows or has 
reasonable cause to believe that the information is inaccurate. 


Reporting information after notice and confirmation of errors. 
A person shall not furnish information relating to a consumer to 
any consumer reporting agency if 


(i) _ the person has been notified by the consumer, at the 
address specified by the person for such notices, that 
specific information is inaccurate; and 

(ii) the information is, in fact, inaccurate. 

No address requirement. A person who clearly and conspicu- 

ously specifies to the consumer an address for notices referred 

to in subparagraph (B) shall not be subject to subparagraph (A); 

however, nothing in subparagraph (B) shall require a person to 

specify such an address. 


Definition. For purposes of subparagraph (A), the term 
“reasonable cause to believe that the information is inaccurate” 
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means having specific knowledge, other than solely allegations 
by the consumer, that would cause a reasonable person to have 
substantial doubts about the accuracy of the information. 


(E) Rehabilitation of private education loans. 


(i) Jn general. Notwithstanding any other provision of this 
section, a consumer may request a financial institution to 
remove from a consumer report a reported default 
regarding a private education loan, and such information 
shall not be considered inaccurate, if 


(1) the financial institution chooses to offer a loan 
rehabilitation program which includes, without 
limitation, a requirement of the consumer to make 
consecutive on-time monthly payments in a number 
that demonstrates, in the assessment of the financial 
institution offering the loan rehabilitation program, a 
renewed ability and willingness to repay the loan; and 


(II) the requirements of the loan rehabilitation program 
described in subclause (I) are successfully met. 


(ii) Banking agencies. 


(1) Jn general. If a financial institution is supervised by a 
Federal banking agency, the financial institution 
shall seek written approval concerning the terms 
and conditions of the loan rehabilitation program 
described in clause (i) from the appropriate Federal 
banking agency. 


(II) Feedback. An appropriate Federal banking agency 
shall provide feedback to a financial institution within 
120 days of a request for approval under subclause (1). 


(iii) Limitation. 
(1) In general. A consumer may obtain the benefits 


available under this subsection with respect to 
rehabilitating a loan only 1 time per loan. 


(I) Rule of construction. Nothing in this subparagraph 
may be construed to require a financial institution to 
offer a loan rehabilitation program or to remove any 
reported default from a consumer report as a 
consideration of a loan rehabilitation program, 
except as described in clause (i). 
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(iv) Definitions. For purposes of this subparagraph 


(I) 


dD) 


the term ‘appropriate Federal banking agency’ has the 
meaning given the term in section 3 of the Federal 
Deposit Insurance Act (12 U.S.C. 1813); and 


the term ‘private education loan’ has the meaning 
given the term in section 140(a) of the Truth in 
Lending Act (15 U.S.C. 1650(a)). 


(F) Reporting information during COVID-19 pandemic.— 


(i) Definitions.—In this subsection: 


(1) Accommodation.—The term ‘accommodation’ includes 


(I) 


an agreement to defer 1 or more payments, make a 
partial payment, forbear any delinquent amounts, 
modify a loan or contract, or any other assistance or 
relief granted to a consumer who is affected by the 
coronavirus disease 2019 (COVID-19) pandemic 
during the covered period. 


Covered period.—The term ‘covered period’ means 
the period beginning on January 31, 2020 and ending 
on the later of— 


(aa) 120 days after the date of enactment of this 
subparagraph; or 

(bb) 120 days after the date on which the national 
emergency concerning the novel coronavirus 
disease (COVID-19) outbreak declared by 
the President on March 13, 2020 under the 
National Emergencies Act (50 U.S.C. 1601 
et seq.) terminates. 


Gi) Reporting.—Except as provided in clause if a furnisher 
makes an accommodation with respect to 1 or more 
payments on a credit obligation or account of a 
consumer, and the consumer makes the payments or is 
not required to make | or more payments pursuant to the 
accommodation, the furnisher shall— 


(1) 
() 


report the credit obligation or account as current; or 


if the credit obligation or account was delinquent 
before the accommodation— 
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(aa) maintain the delinquent status during the period 
in which the accommodation is in effect; and 


(bb) if the consumer brings the credit obligation or 
account current during the period described in item 


(aa), report the credit obligation or account as current. 


(iii) Exception.—Clause (ii) shall not apply with respect to a 
credit obligation or account of a consumer that has been 
charged-off. 


(2) Duty to correct and update information. A person who 


(A) regularly and in the ordinary course of business furnishes 
information to one or more consumer reporting agencies about 
the person’s transactions or experiences with any consumer; and 


(B) has furnished to a consumer reporting agency information 
that the person determines is not complete or accurate, shall 
promptly notify the consumer reporting agency of that determi- 
nation and provide to the agency any corrections to that infor- 
mation, or any additional information, that is necessary to make 
the information provided by the person to the agency complete 
and accurate, and shall not thereafter furnish to the agency any 
of the information that remains not complete or accurate. 


(3) Duty to provide notice of dispute. If the completeness or accuracy of 


any information furnished by any person to any consumer reporting 
agency is disputed to such person by a consumer, the person may not 
furnish the information to any consumer reporting agency without 
notice that such information is disputed by the consumer. 


(4) Duty to provide notice of closed accounts. A person who regularly 


(5) 


and in the ordinary course of business furnishes information to a 
consumer reporting agency regarding a consumer who has a credit 
account with that person shall notify the agency of the voluntary 
closure of the account by the consumer, in information regularly 
furnished for the period in which the account is closed. 


Duty to Provide Notice of Delinquency of Accounts 


(A) Jn general. A person who furnishes information to a consumer 
reporting agency regarding a delinquent account being placed 
for collection, charged to profit or loss, or subjected to any 
similar action shall, not later than 90 days after furnishing the 
information, notify the agency of the date of delinquency on 
the account, which shall be the month and year of the 
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commencement of the delinquency on the account that 
immediately preceded the action. 


Rule of construction. For purposes of this paragraph only, and 
provided that the consumer does not dispute the information, a 
person that furnishes information on a delinquent account that is 
placed for collection, charged for profit or loss, or subjected to 
any similar action, complies with this paragraph, if - 


(i) _ the person reports the same date of delinquency as that 
provided by the creditor to which the account was owed at 
the time at which the commencement of the delinquency 
occurred, if the creditor previously reported that date of 
delinquency to a consumer reporting agency; 


(ii) the creditor did not previously report the date of 
delinquency to a consumer reporting agency, and the 
person establishes and follows reasonable procedures to 
obtain the date of delinquency from the creditor or another 
reliable source and reports that date to a consumer 
reporting agency as the date of delinquency; or 


(iii) the creditor did not previously report the date of 
delinquency to a consumer reporting agency and the date 
of delinquency cannot be reasonably obtained as provided 
in clause (ii), the person establishes and follows reasonable 
procedures to ensure the date reported as the date of 
delinquency precedes the date on which the account is 
placed for collection, charged to profit or loss, or 
subjected to any similar action, and reports such date to 
the credit reporting agency. 


(6) Duties of Furnishers Upon Notice of Identity Theft-Related Information 


(A) Reasonable procedures. A person that furnishes information to 


(B) 


any consumer reporting agency shall have in place reasonable 
procedures to respond to any notification that it receives from 
a consumer reporting agency under section 605B relating to 
information resulting from identity theft, to prevent that person 
from refurnishing such blocked information. 


Information alleged to result from identity theft. If a consumer 
submits an identity theft report to a person who furnishes 
information to a consumer reporting agency at the address 
specified by that person for receiving such reports stating that 
information maintained by such person that purports to relate to 
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the consumer resulted from identity theft, the person may not 
furnish such information that purports to relate to the consumer 
to any consumer reporting agency, unless the person 
subsequently knows or is informed by the consumer that the 
information is correct. 


(7) Negative Information 


(A) Notice to Consumer Required 


(B) 


(C) 


(i) 


(ii) 


In general. If any financial institution that extends credit 
and regularly and in the ordinary course of business 
furnishes information to a consumer reporting agency 
described in section 603(p) furnishes negative information 
to such an agency regarding credit extended to a 
customer, the financial institution shall provide a notice of 
such furnishing of negative information, in writing, to the 
customer. 


Notice effective for subsequent submissions. After 
providing such notice, the financial institution may submit 
additional negative information to a consumer reporting 
agency described in section 603(p) with respect to the 
same transaction, extension of credit, account, or customer 
without providing additional notice to the customer. 


Time of Notice 


(i) 


(ii) 


In general. The notice required under subparagraph (A) 
shall be provided to the customer prior to, or no later than 
30 days after, furnishing the negative information to a 
consumer reporting agency described in section 603(p). 


Coordination with new account disclosures. If the notice is 
provided to the customer prior to furnishing the negative 
information to a consumer reporting agency, the notice 
may not be included in the initial disclosures provided 
under section 127(a) of the Truth in Lending Act. 


Coordination with other disclosures. The notice required under 
subparagraph (A) - 


(i) 


(ii) 


may be included on or with any notice of default, any 
billing statement, or any other materials provided to the 
customer; and 


must be clear and conspicuous. 
See also 12 CFR Part 1022, App B 
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(D) Model Disclosure 


(i) Duty of Bureau. The Bureau shall prescribe a brief model 
disclosure that a financial institution may use to comply 
with subparagraph (A), which shall not exceed 30 words. 


(ii) Use of model not required. No provision of this paragraph 
may be construed to require a financial institution to use 
any such model form prescribed by the Bureau. 


(iii) Compliance using model. A financial institution shall be 
deemed to be in compliance with subparagraph (A) if the 
financial institution uses any model form prescribed by the 
Bureau under this subparagraph, or the financial institution 
uses any such model form and rearranges its format. 


(E) Use of notice without submitting negative information. No 
provision of this paragraph shall be construed as requiring a 
financial institution that has provided a customer with a notice 
described in subparagraph (A) to furnish negative information 
about the customer to a consumer reporting agency. 


(F) Safe harbor. A financial institution shall not be liable for 
failure to perform the duties required by this paragraph if, at the 
time of the failure, the financial institution maintained 
reasonable policies and procedures to comply with this paragraph 
or the financial institution reasonably believed that the institution 
is prohibited, by law, from contacting the consumer. 


(G) Definitions. For purposes of this paragraph, the following 
definitions shall apply: 


(i) The term “negative information” means information 
concerning a customer’s delinquencies, late payments, 
insolvency, or any form of default. 


(ii) The terms “customer” and “financial institution” have the 
same meanings as in section 509 Public Law 106-102. 


(8) Ability of Consumer to Dispute Information Directly with Furnisher 


See also 12 CFR Part 1022.43, 16 CFR Part 660.4, 
74 Fed. Reg. 31484 (07/01/09) 


(A) Jn general. The Bureau, in consultation with the Federal Trade 
Commission, the Federal banking agencies, and the National 
Credit Union Administration, shall prescribe regulations that 
shall identify the circumstances under which a furnisher shall 
be required to reinvestigate a dispute concerning the accuracy 
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(B) 


(C) 


(D) 


(E) 


of information contained in a consumer report on the consumer, 
based on a direct request of a consumer. 


Considerations. In prescribing regulations under subparagraph 
(A), the agencies shall weigh — 


(i) the benefits to consumers with the costs on furnishers and 
the credit reporting system; 


(ii) the impact on the overall accuracy and integrity of 
consumer reports of any such requirements; 


(iii) whether direct contact by the consumer with the furnisher 
would likely result in the most expeditious resolution of 
any such dispute; and 


(iv) the potential impact on the credit reporting process if 
credit repair organizations, as defined in section 403(3) 
[15 U.S.C. §1679a(3)], including entities that would be a 
credit repair organization, but for section 403(3)(B)(i), are 
able to circumvent the prohibition in subparagraph (G). 


Applicability. Subparagraphs (D) through (G) shall apply in 
any circumstance identified under the regulations promulgated 
under subparagraph (A). 


Submitting a notice of dispute. A consumer who seeks to 
dispute the accuracy of information shall provide a dispute 
notice directly to such person at the address specified by the 
person for such notices that - 


(i) identifies the specific information that is being disputed; 
(ii) explains the basis for the dispute; and 


(iii) includes all supporting documentation required by the 
furnisher to substantiate the basis of the dispute. 


Duty of person after receiving notice of dispute. After receiving 
a notice of dispute from a consumer pursuant to subparagraph 
(D), the person that provided the information in dispute to a 
consumer reporting agency shall - 


(i) conduct an investigation with respect to the disputed 
information; 


(ii) review all relevant information provided by the consumer 
with the notice; 
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complete such person’s investigation of the dispute and 
report the results of the investigation to the consumer 
before the expiration of the period under section 611(a) 
(1) within which a consumer reporting agency would be 
required to complete its action if the consumer had elected 
to dispute the information under that section; and 


if the investigation finds that the information reported was 
inaccurate, promptly notify each consumer reporting 
agency to which the person furnished the inaccurate 
information of that determination and provide to the 
agency any correction to that information that is necessary 
to make the information provided by the person accurate. 


(F) Frivolous or Irrelevant Dispute 


(i) 


(ii) 


(iii) 


In general. This paragraph shall not apply if the person 
receiving a notice of a dispute from a consumer 
reasonably determines that the dispute is frivolous or 
irrelevant, including - 


(1) by reason of the failure of a consumer to provide 
sufficient information to investigate the disputed 
information; or 


(II) the submission by a consumer of a dispute that is 
substantially the same as a dispute previously 
submitted by or for the consumer, either directly to 
the person or through a consumer reporting agency 
under subsection (b), with respect to which the person 
has already performed the person’s duties under this 
paragraph or subsection (b), as applicable. 


Notice of determination. Upon making any determination 
under clause (i) that a dispute is frivolous or irrelevant, 
the person shall notify the consumer of such determination 
not later than 5 business days after making such determination, 
by mail or, if authorized by the consumer for that purpose, 
by any other means available to the person. 


Contents of notice. A notice under clause (ii) shall include - 
(1) the reasons for the determination under clause (i); and 


(I) identification of any information required to investigate 
the disputed information, which may consist of a 
standardized form describing the general nature of 
such information. 
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(G) Exclusion of credit repair organizations. This paragraph shall 
not apply if the notice of the dispute is submitted by, is 
prepared on behalf of the consumer by, or is submitted on a 
form supplied to the consumer by, a credit repair organization, 
as defined in section 403(3), or an entity that would be a credit 
repair organization, but for section 403(3)(B)(i). 


(9) Duty to provide notice of status as medical information furnisher. 
A person whose primary business is providing medical services, 
products, or devices, or the person’s agent or assignee, who furnishes 
information to a consumer reporting agency on a consumer shall be 
considered a medical information furnisher for purposes of this title, 
and shall notify the agency of such status. 


(b) Duties of Furnishers of Information upon Notice of Dispute 


(1) Jn general. After receiving notice pursuant to section 611(a)(2) 
[§ 1681i] of a dispute with regard to the completeness or accuracy 
of any information provided by a person to a consumer reporting 
agency, the person shall 


(A) conduct an investigation with respect to the disputed information; 


(B) review all relevant information provided by the consumer 
reporting agency pursuant to section 611(a)(2) [§ 1681i]; 


(C) report the results of the investigation to the consumer 
reporting agency; 

(D) _ if the investigation finds that the information is incomplete or inac- 
curate, report those results to all other consumer reporting agen- 
cies to which the person furnished the information and that compile 
and maintain files on consumers on a nationwide basis; and 


(E) if an item of information disputed by a consumer is found to 
be inaccurate or incomplete or cannot be verified after any 
reinvestigation under paragraph (1), for purposes of reporting 
to a consumer reporting agency only, as appropriate, based on 
the results of the reinvestigation promptly - 

(i) modify that item of information; 
(ii) delete that item of information; or 
(iii) permanently block the reporting of that item of information. 
(2) Deadline. A person shall complete all investigations, reviews, and 
reports required under paragraph (1) regarding information provided 
by the person to a consumer reporting agency, before the expiration 
of the period under section 611(a)(1) [§ 1681i] within which the 
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consumer reporting agency is required to complete actions required 
by that section regarding that information. 


(c) Limitation on liability. Except as provided in section 621(c)(1)(B), 
sections 616 and 617 do not apply to any violation of - 


(d) 


(e) 


(1) 


(2) 


(3) 


subsection (a) of this section, including any regulations issued 
thereunder; 

subsection (e) of this section, except that nothing in this paragraph 
shall limit, expand, or otherwise affect liability under section 616 or 
617, as applicable, for violations of subsection (b) of this section; or 
subsection (e) of section 615. 


Limitation on enforcement. The provisions of law described in paragraphs 
(1) through (3) of subsection (c) (other than with respect to the exception 
described in paragraph (2) of subsection (c)) shall be enforced exclusively 
as provided under section 621 by the Federal agencies and officials and 
the State officials identified in section 621. 


Accuracy Guidelines and Regulations Required 


(1) 


(2) 


See also 12 CFR Part 1022, Subpart E, 16 CFR Part 660, 
74 Fed. Reg. 31484 (07/01/09), 86 Fed. Reg. 51819-21 (09/17/21) 


Guidelines. The Bureau shall, with respect to persons or entities that are 
subject to the enforcement authority of the Bureau under section 621 - 


(A) establish and maintain guidelines for use by each person that 
furnishes information to a consumer reporting agency regarding 
the accuracy and integrity of the information relating to 
consumers that such entities furnish to consumer reporting 
agencies, and update such guidelines as often as necessary; and 


(B) prescribe regulations requiring each person that furnishes 
information to a consumer reporting agency to establish 
reasonable policies and procedures for implementing the 
guidelines established pursuant to subparagraph (A). 


Criteria. In developing the guidelines required by paragraph (1)(A), 
the Bureau shall - 


(A) _ identify patterns, practices, and specific forms of activity that 
can compromise the accuracy and integrity of information 
furnished to consumer reporting agencies; 
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(B) 


(C) 


(D) 


review the methods (including technological means) used to 
furnish information relating to consumers to consumer 
reporting agencies; 


determine whether persons that furnish information to consumer 
reporting agencies maintain and enforce policies to ensure the 
accuracy and integrity of information furnished to consumer 
reporting agencies; and 

examine the policies and processes that persons that furnish 
information to consumer reporting agencies employ to conduct 
re investigations and correct inaccurate information relating to 
consumers that has been furnished to consumer reporting agencies. 


§624. Affiliate sharing [15 U.S.C. § 1681s-3] 


See also 12 CFR Part 1022, Subpart C, App C, 
16 CFR Parts 680, 698 App B, 74 Fed. Reg. 22639-40 (05/14/09), 
72 Fed. Reg. 61455-64 (10/30/07), 86 Fed. Reg. 51609-11 (09/16/21) 


(a) Special Rule for Solicitation for Purposes of Marketing 


(1) Notice. Any person that receives from another person related to it by 
common ownership or affiliated by corporate control a communication 
of information that would be a consumer report, but for clauses (i), 
(ii), and (iii) of section 603(d)(2)(A), may not use the information to 
make a solicitation for marketing purposes to a consumer about its 
products or services, unless — 


(2) 


(A) 


(B) 


it is clearly and conspicuously disclosed to the consumer that 
the information may be communicated among such persons for 
purposes of making such solicitations to the consumer; and 


the consumer is provided an opportunity and a simple method 
to prohibit the making of such solicitations to the consumer by 
such person. 


Consumer Choice 


(A) 


In general. The notice required under paragraph (1) shall 
allow the consumer the opportunity to prohibit all solicitations 
referred to in such paragraph, and may allow the consumer 

to choose from different options when electing to prohibit the 
sending of such solicitations, including options regarding the 
types of entities and information covered, and which methods 
of delivering solicitations the consumer elects to prohibit. 
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Format. Notwithstanding subparagraph (A), the notice 
required under paragraph (1) shall be clear, conspicuous, and 
concise, and any method provided under paragraph (1)(B) shall 
be simple. The regulations prescribed to implement this section 
shall provide specific guidance regarding how to comply with 
such standards. 


(3) Duration 


(A) 


(B) 


In general. The election of a consumer pursuant to paragraph 
(1)(B) to prohibit the making of solicitations shall be effective 
for at least 5 years, beginning on the date on which the person 
receives the election of the consumer, unless the consumer 
requests that such election be revoked. 


Notice upon expiration of effective period. At such time as the 
election of a consumer pursuant to paragraph (1)(B) is no longer 
effective, a person may not use information that the person 
receives in the manner described in para-graph (1) to make any 
solicitation for marketing purposes to the consumer, unless the 
consumer receives a notice and an opportunity, using a simple 
method, to extend the opt-out for another period of at least 5 
years, pursuant to the procedures described in paragraph (1). 


(4) Scope. This section shall not apply to a person - 


(A) 


(B) 


(C) 


(D) 


using information to make a solicitation for marketing 
purposes to a consumer with whom the person has a pre- 
existing business relationship; 


using information to facilitate communications to an individual 
for whose benefit the person provides employee benefit or other 
services pursuant to a contract with an employer related to and 
arising out of the current employment relationship or status of 
the individual as a participant or beneficiary of an employee 
benefit plan; 


using information to perform services on behalf of another 
person related by common ownership or affiliated by corporate 
control, except that this subparagraph shall not be construed as 
permitting a person to send solicitations on behalf of another 
person, if such other person would not be permitted to send the 
solicitation on its own behalf as a result of the election of the 
consumer to prohibit solicitations under paragraph (1)(B); 


using information in response to a communication initiated by 
the consumer; 
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(b) 


(c) 


(d) 


(E) using information in response to solicitations authorized or 
requested by the consumer; or 


(F) if compliance with this section by that person would prevent 
compliance by that person with any provision of State insurance 
laws pertaining to unfair discrimination in any State in which 
the person is lawfully doing business. 


(5) No retroactivity. This subsection shall not prohibit the use of 
information to send a solicitation to a consumer if such information 
was received prior to the date on which persons are required to 
comply with regulations implementing this subsection. 


Notice for other purposes permissible. A notice or other disclosure 
under this section may be coordinated and consolidated with any other 
notice required to be issued under any other provision of law by a 
person that is subject to this section, and a notice or other disclosure 
that is equivalent to the notice required by subsection (a), and that is 
provided by a person described in subsection (a) to a consumer together 
with disclosures required by any other provision of law, shall satisfy the 
requirements of subsection (a). 


User requirements. Requirements with respect to the use by a person 

of information received from another person related to it by common 
ownership or affiliated by corporate control, such as the requirements 
of this section, constitute requirements with respect to the exchange of 
information among persons affiliated by common ownership or common 
corporate control, within the meaning of section 625(b)(2). 


Definitions. For purposes of this section, the following definitions shall apply: 


(1) The term “pre-existing business relationship” means a relationship 
between a person, or a person’s licensed agent, and a consumer, 
based on - 


(A) a financial contract between a person and a consumer which is 
in force; 


(B) the purchase, rental, or lease by the consumer of that person’s 
goods or services, or a financial transaction (including holding 
an active account or a policy in force or having another 
continuing relationship) between the consumer and that person 
during the 18-month period immediately preceding the date on 
which the consumer is sent a solicitation covered by this section; 


(C) an inquiry or application by the consumer regarding a product 
or service offered by that person, during the 3-month period 
immediately preceding the date on which the consumer is sent a 


solicitation covered by this section; or 
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any other pre-existing customer relationship defined in the 
regulations implementing this section. 


(2) The term “solicitation” means the marketing of a product or service 
initiated by a person to a particular consumer that is based on an 
exchange of information described in subsection (a), and is intended 
to encourage the consumer to purchase such product or service, but 
does not include communications that are directed at the general 
public or determined not to be a solicitation by the regulations 
prescribed under this section. 


§ 625. Relation to State laws [15 U.S.C. § 1681t] 


(a) In general. Except as provided in subsections (b) and (c), this title does 
not annul, alter, affect, or exempt any person subject to the provisions of 
this title from complying with the laws of any State with respect to the 
collection, distribution, or use of any information on consumers, or for 
the prevention or mitigation of identity theft, except to the extent that 
those laws are inconsistent with any provision of this title, and then only 
to the extent of the inconsistency. 


General exceptions. No requirement or prohibition may be imposed under 
the laws of any State 


(1) with respect to any subject matter regulated under 


(A) 


(B) 


(C) 


(D) 


(E) 


subsection (c) or (e) of section 604 [§ 1681b], relating to the 
prescreening of consumer reports; 


section 611 [§ 1681i], relating to the time by which a consumer 
reporting agency must take any action, including the provision 
of notification to a consumer or other person, in any procedure 
related to the disputed accuracy of information in a consumer’s 
file, except that this subparagraph shall not apply to any State 
law in effect on the date of enactment of the Consumer Credit 
Reporting Reform Act of 1996; 


subsections (a) and (b) of section 615 [§ 1681m], relating to the 
duties of a person who takes any adverse action with respect to 
a consumer; 


section 615(d) [§ 1681m], relating to the duties of persons who 
use a consumer report of a consumer in connection with any 
credit or insurance transaction that is not initiated by the con- 
sumer and that consists of a firm offer of credit or insurance; 


section 605 [§ 1681c], relating to information contained in 
consumer reports, except that this subparagraph shall not apply 
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(2) 


(3) 


to any State law in effect on the date of enactment of the 
Consumer Credit Reporting Reform Act of 1996; 


(F) section 623 [§ 1681s-2], relating to the responsibilities of 
persons who furnish information to consumer reporting 
agencies, except that this paragraph shall not apply 


(i) with respect to section 54A(a) of chapter 93 of the 
Massachusetts Annotated Laws (as in effect on the date of 
enactment of the Consumer Credit Reporting Reform Act 
of 1996); or 


(ii) with respect to section 1785.25(a) of the California Civil 
Code (as in effect on the date of enactment of the 
Consumer Credit Reporting Reform Act of 1996); 


(G) section 609(e), relating to information available to victims 
under section 609(e); 


(H) section 624, relating to the exchange and use of information to 
make a solicitation for marketing purposes; 


(1) — section 615(h), relating to the duties of users of consumer 
reports to provide notice with respect to terms in certain credit 
transactions; 


(J) subsections (i) and (j) of section 605A relating to security 
freezes; or 


(K) subsection (k) of section 605A, relating to credit monitoring for 
active duty military consumers, as defined in that subsection; 


with respect to the exchange of information among persons affiliated 
by common ownership or common corporate control, except that this 
paragraph shall not apply with respect to subsection (a) or (c)(1) of 
section 2480e of title 9, Vermont Statutes Annotated (as in effect on 
the date of enactment of the Consumer Credit Reporting Reform Act 
of 1996); 


with respect to the disclosures required to be made under subsection 

(c), (d), (e), or (g) of section 609, or subsection (f) of section 609 

relating to the disclosure of credit scores for credit granting purposes, 

except that this paragraph - 

(A) shall not apply with respect to sections 1785.10, 1785.16, and 
1785 .20.2 of the California Civil Code (as in effect on the date 
of enactment of the Fair and Accurate Credit Transactions Act 
of 2003) and section 1785.15 through section 1785.15.2 of such 
Code (as in effect on such date); 
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shall not apply with respect to sections 5-3-106(2) and 212- 
14.3-104.3 of the Colorado Revised Statutes (as in effect on the 
date of enactment of the Fair and Accurate Credit Transactions 
Act of 2003); and 


shall not be construed as limiting, annulling, affecting, or 
superseding any provision of the laws of any State regulating 
the use in an insurance activity, or regulating disclosures 
concerning such use, of a credit-based insurance score of a 
consumer by any person engaged in the business of insurance; 


with respect to the frequency of any disclosure under section 612(a), 
except that this paragraph shall not apply - 


(A) 


(B) 


(C) 


(D) 


(E) 


(F) 


(G) 


with respect to section 12-14.3-105(1)(d) of the Colorado 
Revised Statutes (as in effect on the date of enactment of the 
Fair and Accurate Credit Transactions Act of 2003); 


with respect to section 10-1-393(29)(C) of the Georgia Code 
(as in effect on the date of enactment of the Fair and Accurate 
Credit Transactions Act of 2003); 

with respect to section 1316.2 of title 10 of the Maine Revised 
Statutes (as in effect on the date of enactment of the Fair and 
Accurate Credit Transactions Act of 2003); 

with respect to sections 14-1209(a)(1) and 14-1209(b)(1)(@) of 
the Commercial Law Article of the Code of Maryland (as in 
effect on the date of enactment of the Fair and Accurate Credit 
Transactions Act of 2003); 

with respect to section 59(d) and section 59(e) of chapter 93 
of the General Laws of Massachusetts (as in effect on the date 
of enactment of the Fair and Accurate Credit Transactions Act 
of 2003); 

with respect to section 56:11-37.10(a)(1) of the New Jersey 
Revised Statutes (as in effect on the date of enactment of the 
Fair and Accurate Credit Transactions Act of 2003); or 

with respect to section 2480c(a)(1) of title 9 of the Vermont 
Statutes Annotated (as in effect on the date of enactment of the 
Fair and Accurate Credit Transactions Act of 2003); or 


with respect to the conduct required by the specific provisions of - 


(A) 
(B) 
(C) 
(D) 


section 605(g); 
section 605A; 
section 605B; 
section 609(a)(1)(A); 
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(E) _ section 612(a); 


(F) subsections (e), (f), and (g) of section 615; 
(G) _ section 621(f); 

(H) section 623(a)(6); or 

(I) — section 628. 


(c) Definition of firm offer of credit or insurance. Notwithstanding any 


(d) 


definition of the term “firm offer of credit or insurance” (or any equiva- 
lent term) under the laws of any State, the definition of that term contained 
in section 603(/) [§ 1681a] shall be construed to apply in the enforcement 
and interpretation of the laws of any State governing consumer reports. 


Limitations. Subsections (b) and (c) do not affect any settlement, 
agreement, or consent judgment between any State Attorney General and 
any consumer reporting agency in effect on the date of enactment of the 
Consumer Credit Reporting Reform Act of 1996. 


§ 626. Disclosures to FBI for counterintelligence purposes 


(a) 


(b) 


[15 U.S.C. § 1681u] 


Identity of financial institutions. Notwithstanding section 604 [§ 1681b] or 
any other provision of this title, a consumer reporting agency shall furnish 
to the Federal Bureau of Investigation the names and addresses of all 
financial institutions (as that term is defined in section 1101 of the Right 
to Financial Privacy Act of 1978 [12 U.S.C. § 3401]) at which a 
consumer maintains or has maintained an account, to the extent that 
information is in the files of the agency, when presented with a written 
request for that information that includes a term that specifically identifies 
a consumer or account to be used as the basis for the production of that 
information, signed by the Director of the Federal Bureau of Investigation, 
or the Director’s designee in a position not lower than Deputy Assistant 
Director at Bureau headquarters or a Special Agent in Charge of a Bureau 
field office designated by the Director, which certifies compliance with 
this section. The Director or the Director’s designee may make such a 
certification only if the Director or the Director’s designee has determined 
in writing, that such information is sought for the conduct of an authorized 
investigation to protect against international terrorism or clandestine 
intelligence activities, provided that such an investigation of a United 
States person is not conducted solely upon the basis of activities protected 
by the first amendment to the Constitution of the United States. 


Identifying information. Notwithstanding the provisions of section 604 
[§ 1681b] of this title or any other provision of this subchapter, a 
consumer reporting agency shall furnish identifying information respecting 
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a consumer, limited to name, address, former addresses, places of 
employment, or former places of employment, to the Federal Bureau of 
Investigation when presented with a written request that includes a term 
that specifically identifies a consumer or account to be used as the basis 
for the production of that information, signed by the Director or the 
Director’s designee in a position not lower than Deputy Assistant Director 
at Bureau headquarters or a Special Agent in Charge of a Bureau field 
office designated by the Director, which certifies compliance with this 
subsection. The Director or the Director’s designee may make such a 
certification only if the Director or the Director’s designee has determined 
in writing that such information is sought for the conduct of an authorized 
investigation to protect against international terrorism or clandestine 
intelligence activities, provided that such an investigation of a United 
States person is not conducted solely upon the basis of activities protected 
by the first amendment to the Constitution of the United States. 


Court order for disclosure of consumer reports. Notwithstanding section 
604 [§ 1681b] of this title or any other provision of this subchapter, 

if requested in writing by the Director of the Federal Bureau of 
Investigation, or a designee of the Director in a position not lower than 
Deputy Assistant Director at Bureau headquarters or a Special Agent 

in Charge of a Bureau field office designated by the Director, a court 

may issue an order ex parte, which shall include a term that specifically 
identifies a consumer or account to be used as the basis for the production 
of the information, directing a consumer reporting agency to furnish a 
consumer report to the Federal Bureau of Investigation, upon a showing in 
camera that the consumer report is sought for the conduct of an authorized 
investigation to protect against international terrorism or clandestine 
intelligence activities, provided that such an investigation of a United 
States person is not conducted solely upon the basis of activities protected 
by the first amendment to the Constitution of the United States. The terms 
of an order issued under this subsection shall not disclose that the order is 
issued for purposes of a counterintelligence investigation. 


Prohibition of certain disclosure. 
(1) Prohibition 
(A) In general 
If a certification is issued under subparagraph (B) and notice 
of the right to judicial review under subsection (e) is provided, 
no consumer reporting agency that receives a request under 


subsection (a) or (b) or an order under subsection (c), or of- 
ficer, employee, or agent thereof, shall disclose or specify in 
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(B) 


any consumer report, that the Federal Bureau of Investigation 
has sought or obtained access to information or records under 
subsection (a), (b), or (c). 

Certification 

The requirement of subparagraph (A) shall apply if the Direc- 
tor of the Federal Bureau of Investigation, or a designee of the 
Director whose rank shall be no lower than Deputy Assistant 
Director at Bureau headquarters or a Special Agent in Charge 
of a Bureau field office, certifies that the absence of a prohibi- 
tion of disclosure under this subsection may result in - 


(i) a danger to the national security of the United States; 


(ii) interference with a criminal, counterterrorism or counter- 
intelligence investigation; 


(iii) interference with diplomatic relations; or 
(iv) danger to the life or physical safety of any person. 


(2) Exception 


(A) In general 


(B) 


(C) 


A consumer reporting agency that receives a request under 

subsection (a) or (b) or an order under subsection (c), or officer, 

employee, or agent thereof, may disclose information otherwise 

subject to any applicable nondisclosure requirement to - 

(i) | those persons to whom disclosure is necessary in order to 
comply with the request; 

(ii) an attorney in order to obtain legal advice or assistance 
regarding the request; or 

(iii) other persons as permitted by the Director of the Federal 
Bureau of Investigation or the designee of the Director. 

Application 

A person to whom disclosure is made under subparagraph (A) 

shall be subject to the nondisclosure requirements applicable to 

a person to whom a request under subsection (a) or (b) or an 

order under subsection (c) is issued in the same manner as the 

person to whom the request is issued. 


Notice 

Any recipient that discloses to a person described in 
subparagraph (A) information otherwise subject to a 
nondisclosure requirement shall inform the person of the 
applicable nondisclosure requirement. 
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(e) 


(f) 


(g) 


(h) 


(D) Identification of disclosure recipients 

At the request of the Director of the Federal Bureau of 
Investigation or the designee of the Director, any person 
making or intending to make a disclosure under clause (i) or 
(iii) of subparagraph (A) shall identify to the Director or such 
designee the person to whom such disclosure will be made or to 
whom such disclosure was made prior to the request. 

Judicial review. 


(1) In general 
A request under subsection (a) or (b) or an order under subsection 
(c) or a non-disclosure requirement imposed in connection with such 
request under subsection (d) shall be subject to judicial review under 
section 3511 of title 18. 
(2) Notice 
A request under subsection (a) or (b) or an order under subsection (c) 
shall include notice of the availability of judicial review described in 
paragraph (1). 
Payment of fees. The Federal Bureau of Investigation shall, subject to 
the availability of appropriations, pay to the consumer reporting agency 
assembling or providing report or information in accordance with 
procedures established under this section a fee for reimbursement for such 
costs as are reasonably necessary and which have been directly incurred in 
searching, reproducing, or transporting books, papers, records, or other 
data required or requested to be produced under this section. 
Limit on dissemination. The Federal Bureau of Investigation may not 
disseminate information obtained pursuant to this section outside of the 
Federal Bureau of Investigation, except to other Federal agencies as may 
be necessary for the approval or conduct of a foreign counterintelligence 
investigation, or, where the information concerns a person subject to the 
Uniform Code of Military Justice, to appropriate investigative authorities 
within the military department concerned as may be necessary for the 
conduct of a joint foreign counterintelligence investigation. 
Rules of construction. Nothing in this section shall be construed to 
prohibit information from being furnished by the Federal Bureau of 
Investigation pursuant to a subpoena or court order, in connection with a 
judicial or administrative proceeding to enforce the provisions of this Act. 
Nothing in this section shall be construed to authorize or permit the 
withholding of information from the Congress. 


Reports to Congress 
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@) 


(k) 


(1) 


(1) 


(2) 


On a semiannual basis, the Attorney General shall fully inform the 
Permanent Select Committee on Intelligence and the Committee on 
Banking, Finance and Urban Affairs of the House of Representatives, 
and the Select Committee on Intelligence and the Committee on 
Banking, Housing, and Urban Affairs of the Senate concerning all 
requests made pursuant to subsections (a), (b), and (c) of this section. 


In the case of the semiannual reports required to be submitted under 
paragraph (1) to the Permanent Select Committee on Intelligence 

of the House of Representatives and the Select Committee on 
Intelligence of the Senate, the submittal dates for such reports shall 
be as provided in section 415b of Title 50. 


Damages. Any agency or department of the United States obtaining 

or disclosing any consumer reports, records, or information contained 
therein in violation of this section is liable to the consumer to whom such 
consumer reports, records, or information relate in an amount equal to 
the sum of 


(1) 
(2) 
(3) 


(4) 


$100, without regard to the volume of consumer reports, records, 
or information involved; 

any actual damages sustained by the consumer as a result of 

the disclosure; 

if the violation is found to have been willful or intentional, such 
punitive damages as a court may allow; and 

in the case of any successful action to enforce liability under this 
subsection, the costs of the action, together with reasonable attorney 
fees, as determined by the court. 


Disciplinary actions for violations. If a court determines that any agency 
or department of the United States has violated any provision of this 
section and the court finds that the circumstances surrounding the violation 
raise questions of whether or not an officer or employee of the agency or 
department acted willfully or intentionally with respect to the violation, 

the agency or department shall promptly initiate a proceeding to determine 
whether or not disciplinary action is warranted against the officer or 
employee who was responsible for the violation. 


Good-faith exception. Notwithstanding any other provision of this 
subchapter, any consumer reporting agency or agent or employee thereof 
making disclosure of consumer reports or identifying information pursuant 
to this subsection in good-faith reliance upon a certification of the Federal 
Bureau of Investigation pursuant to provisions of this section shall not be 
liable to any person for such disclosure under this title, the constitution 
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of any State, or any law or regulation of any State or any political 
subdivision of any State. 


(m) Limitation of remedies. Notwithstanding any other provision of this 


(n) 


subchapter, the remedies and sanctions set forth in this section shall be the 
only judicial remedies and sanctions for violation of this section. 


Injunctive relief. In addition to any other remedy contained in this 

section, injunctive relief shall be available to require compliance with the 
procedures of this section. In the event of any successful action under this 
subsection, costs together with reasonable attorney fees, as determined by 
the court, may be recovered. 


§ 627. Disclosures to governmental agencies for 


(a) 


(b) 


(c) 


counterterrorism purposes [15 U.S.C. § 1681v] 


Disclosure. Notwithstanding section 604 or any other provision of this title, 
a consumer reporting agency shall furnish a consumer report of a consumer 
and all other information in a consumer’s file to a government agency 
authorized to conduct investigations of, or intelligence or counterintelligence 
activities or analysis related to, international terrorism when presented with 
a written certification by such government agency that such information is 
necessary for the agency’s conduct or such investigation, activity or analysis 
and that includes a term that specifically identifies a consumer or account to 
be used as the basis for the production of such information. 


Form of certification. The certification described in subsection (a) shall 
be signed by a supervisory official designated by the head of a Federal 
agency or an officer of a Federal agency whose appointment to office is 
required to be made by the President, by and with the advice and consent 
of the Senate. 


Prohibition of certain disclosure. 
(1) Prohibition 


(A) In general 
If a certification is issued under subparagraph (B) and notice 
of the right to judicial review under subsection (d) is provided, 
no consumer reporting agency that receives a request under 
subsection (a), or officer, employee, or agent thereof, shall 
disclose or specify in any consumer report, that a government 
agency described in subsection (a) has sought or obtained 
access to information or records under subsection (a). 

(B) Certification 
The requirements of subparagraph (A) shall apply if the head 
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of the government agency described in subsection (a), or a 
designee, certifies that the absence of a prohibition of disclosure 
under this subsection may result in- 


(i) a danger to the national security of the United States; 


(ii) interference with a criminal, counterterrorism, or 
counterintelligence investigation; 


(iii) interference with diplomatic relations; or 


(iv) danger to the life or physical safety of any person. 


(2) Exception 


(A) 


(B) 


(C) 


(D) 


In general 

A consumer reporting agency that receives a request under 
subsection (a), or officer, employee, or agent thereof, may 
disclose information otherwise subject to any applicable 
nondisclosure requirement to- 


(i) _ those persons to whom disclosure is necessary in order to 
comply with the request; 


(ii) an attorney in order to obtain legal advice or assistance 
regarding the request; or 


(iii) other persons as permitted by the head of the government 
agency described in subsection (a) or a designee. 


Application 

A person to whom disclosure is made under subparagraph (A) 
shall be subject to the nondisclosure requirements applicable to 
a person to whom a request under subsection (a) is issued in the 
same manner as the person to whom the request is issued. 


Notice 

Any recipient that discloses to a person described in 
subparagraph (A) information otherwise subject to a 
nondisclosure requirement shall inform the person of the 
applicable nondisclosure requirement. 


Identification of disclosure recipients 

At the request of the head of the government agency described 
in subsection (a) or a designee, any person making or intending 
to make a disclosure under clause (i) or (iii) of subparagraph 
(A) shall identify to the head or such designee the person to 
whom such disclosure will be made or to whom such disclosure 
was made prior to the request. 
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Judicial review 


(1) In general 
A request under subsection (a) or a non-disclosure requirement 
imposed in connection with such request under subsection (c) shall 
be subject to judicial review under section 3511 of title 18. 

(2) Notice 
A request under subsection (a) shall include notice of the availability 
of judicial review described in paragraph (1). 


Rule of construction. Nothing in section 626 shall be construed to limit the 
authority of the Director of the Federal Bureau of Investigation under this section. 


Safe harbor. Notwithstanding any other provision of this subchapter, any 
consumer reporting agency or agent or employee thereof making disclosure 
of consumer reports or other information pursuant to this section in good- 
faith reliance upon a certification of a government agency pursuant to 

the provisions of this section shall not be liable to any person for such 
disclosure under this subchapter, the constitution of any State, or any law or 
regulation of any State or any political subdivision of any State. 


(g) Reports to Congress 


(1) Ona semi-annual basis, the Attorney General shall fully inform the 
Committee on the Judiciary, the Committee on Financial Services, 
and the Permanent Select Committee on Intelligence of the House of 
Representatives and the Committee on the Judiciary, the Committee 
on Banking, Housing, and Urban Affairs, and the Select Committee 
on Intelligence of the Senate concerning all requests made pursuant 
to subsection (a). 

(2) In the case of the semiannual reports required to be submitted under 
paragraph (1) to the Permanent Select Committee on Intelligence 
of the House of Representatives and the Select Committee on 
Intelligence of the Senate, the submittal dates for such reports shall 
be as provided in section 3106 of title 50. 


§ 628. Disposal of records [15 U.S.C. § 1681w] 


(a) 


See also 16 CFR Part 682, 69 Fed. Reg. 68690 (11/24/04) 
Regulations 


(1) Jn general. The Federal Trade Commission, the Securities and 
Exchange Commission, the Commodity Futures Trading 
Commission, the Federal banking agencies, and the National 
Credit Union Administration, with respect to the entities that are 
subject to their respective enforcement authority under section 
621, and in coordination as described in paragraph (2), shall issue 
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(2) 


(3) 


final regulations requiring any person that maintains or otherwise 
possesses consumer information, or any compilation of consumer 
information, derived from consumer reports for a business purpose 
to properly dispose of any such information or compilation. 


Coordination. Each agency required to prescribe regulations under 
paragraph (1) shall - 


(A) consult and coordinate with each other such agency so that, 
to the extent possible, the regulations prescribed by each such 
agency are consistent and comparable with the regulations by 
each such other agency; and 


(B) ensure that such regulations are consistent with the 
requirements and regulations issued pursuant to Public Law 
106-102 and other provisions of Federal law. 


Exemption authority. In issuing regulations under this section, the 
agencies identified in paragraph (1) may exempt any person or class 
of persons from application of those regulations, as such agency 
deems appropriate to carry out the purpose of this section. 


(b) Rule of construction. Nothing in this section shall be construed - 


(1) 


(2) 


to require a person to maintain or destroy any record pertaining to a 
consumer that is not imposed under other law; or 


to alter or affect any requirement imposed under any other provision 
of law to maintain or destroy such a record. 


§ 629. Corporate and technological circumvention prohibited 


[15 U.S.C. § 1681x] 


The Bureau shall prescribe regulations, to become effective not later than 90 
days after the date of enactment of this section, to prevent a consumer reporting 
agency from circumventing or evading treatment as a consumer reporting 
agency described in section 603(p) for purposes of this title, including - 


(1) 


(2) 


by means of a corporate reorganization or restructuring, including a 
merger, acquisition, dissolution, divestiture, or asset sale of a 
consumer reporting agency; or 


by maintaining or merging public record and credit account 
information in a manner that is substantially equivalent to that 
described in paragraphs (1) and (2) of section 603(p), in the manner 
described in section 603(p). 


See also 12 CFR Part 1022.140 
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